IETF-SSH archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Ambiguities in section 3.1 of the keyboard-interactive draft



On Thursday, September 30, 2004 17:24:17 +1000 Damien Miller <djm%mindrot.org@localhost> wrote:

I'm not sure what you would have us do: kbdint doesn't seem to provide a
way for a server to report supported methods to a client and I don't
think it is correct to just ignore what a client has specified and
continue with a random method that the server picks.

Indeed. Imagine the scenario where a user has a Kerberos password and some kind of challenge/response token. Now, suppose the user comes in to work and leaves the token home. He wants to use Kerberos, so he sends a submethod list containing "kerb5". The server doesn't support "kerb5", because the method is called "krb5".

Now, should the server
(a) fail the exchange, reporting that it can't support any of the methods
   the user asked for
(b) continue by arbitrarily selecting the method that requires the
   challenge/response token which the user left at home

?



Home | Main Index | Thread Index | Old Index