RE: [TLS] Conflict between TLS 1.1 (RFC4346) and Krb5 Cipher Suite(RFC2712)

Jeffrey Altman wrote:

> One more revision combining the best of Pasi's and Bodo's text:
> 
>      This message is omitted if the agreed-upon key exchange method is
>      anonymous or uses server authentication method that does not
>      involve certificates.  For all key exchange methods specified in
>      this document except for DH_anon, the server MUST send this
>      message.  For non-anonymous key exchange methods specified
>      elsewhere that do not provide an alternative method of server
>      authentication, the server MUST send this message.  This message
>      will always immediately follow the server hello message.

Improving... except I still prefer an ordering where we first say 
when the message is sent, and the explain the exceptions:

   This message MUST be sent if the agreed-upon key exchange method
   involves certificates for server authentication.  This includes all
   key exchange methods defined in this document except DH_anon. For
   key exchange methods specified elsewhere that are either anonymous
   or provide an alternative method of server authentication, this
   message MUST NOT be sent. This message will always immediately
   follow the server hello message.

Best regards,
Pasi

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls