Subject: What do you do if you can't describe your request is as-req1

From: Sam Hartman <[email-masked]>
Date: Thu, 7 Feb 2002 14:05:14 -0500 (EST)

So, we had this discussion before but I don't think really came to a
conclusion.  Let's say just for argument that I've got a client name I
don't know how to specify in an AS-REQ1.  Clearly I'm planning on
communicating with only new KDCs, but I need to know what to send if
I'm not sure the other end is new.

The request is going to fail, but I want an error back from an old
KDC.  That means I can't just send a new request.

I think I send some sort of bogus old request with a pa-as-req2.  But
what do I put in the bogus old request?

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 7 Feb 2002 14:35:36 -0500

> what do I put in the bogus old request?

I say use bogus names for this - standard bogus names :)

Any names sufficiently unlikely to exist as valid principals will do,
but with bogus names you can make certain that they don't exist in any
realm. At the very least that way if your using a sniffer you'll be
able to see right away that the client is meaning to do an as-req2 that
can't be done as an as-req1.

Cheers,

Nico
-- 
-DISCLAIMER: an automatically appended disclaimer may follow. By posting-
-to a public e-mail mailing list I hereby grant permission to distribute-
-and copy this message.-

Visit our website at http://www.ubswarburg.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.

E-mail transmission cannot be guaranteed to be secure or error-free 
as information could be intercepted, corrupted, lost, destroyed, 
arrive late or incomplete, or contain viruses.  The sender therefore 
does not accept liability for any errors or omissions in the contents 
of this message which arise as a result of e-mail transmission.  If 
verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities or 
related financial instruments.

---

From: Sam Hartman <[email-masked]>
Date: 07 Feb 2002 15:04:41 -0500

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    >> what do I put in the bogus old request?

    Nicolas> I say use bogus names for this - standard bogus names :)

Yeah, but I'm having trouble coming up with someone we as a community
dislike to canonize for the client principal, and not really sure
whether rvd, discuss or POP would make a better server principal.;-)

Seriously, someone should pick specific bogus names for me to use.

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 7 Feb 2002 15:18:23 -0500

> whether rvd, discuss or POP would make a better server principal.;-)

LOL! I don't want to volunteer my principal name...

> Seriously, someone should pick specific bogus names for me to use.

Hows's "bogus_user_had_better_not_exist" and "bogus_service_..."? Too
long, fine, how's "bogus-user"/"bogus-service"?

Cheers,

Nico

---

From: Derek Atkins <[email-masked]>
Date: 07 Feb 2002 18:25:15 -0500

Are strings NULL-terminated or length-encoded?  If the latter, you
could use a one-byte-long string with just the NUL character.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

---

From: Sam Hartman <[email-masked]>
Date: 07 Feb 2002 20:52:02 -0500

>>>>> "Derek" == Derek Atkins <[email-masked]> writes:

    Derek> Are strings NULL-terminated or length-encoded?  If the latter, you
    Derek> could use a one-byte-long string with just the NUL character.

    Derek> -derek

I'm going to take jaltman's suggestion of a single ?.  The suggestions
of null string or string containing null seem more appropriate for my
test cases than protocol description.  Remember we are trying to
maximize interop, not maximize bug discovery.