Correct IAKERB protocol implementation

The initial implementation of IAKERB in MIT krb5 mistakenly used
draft-zhu-ws-kerb instead of draft-kitten-ietf-iakerb, and
additionally used the wrong ASN.1 tag value for the target-realm field
of the IAKERB-HEADER sequence.  Correct the following aspects of the
protocol implementation:

* Require and use framing on all messages, not just the initial
  context token.
* Use extension value 2 for the finish message instead of 1.
* Use key usage value 41 instead of 42 for the finish message
  checksum.
* Use UTF8String (12) for target-realm instead of OCTET STRING (4).

With these changes, the IAKERB implementation is interoperable with
other krb5 implementations, but not with the implementation before
these changes.

ticket: 9123 (new)

0 files changed, 0 insertions, 0 deletions