Subject: Section 3.4 of secsh-auth-kdbinteract-01

From: Darren Moffat <[email-masked]>
Date: Mon, 18 Dec 2000 19:09:48 -0800 (PST)

Comments on Section 3.4

   If the server responds with a failure message, it SHOULD delay a
   minimum of 2 seconds before sending the failure message, to limit
   certain types of attacks.

I think this is an implementation detail and many implementations would
want to make this a tuneable value, I don't think the draft should put
a lower bound on this of 2 seconds.   I would rather the text said:

   If the server intends to respond with a failure message, it MAY delay
   for an implementation dependant time before sending to the client.
   It is suspected that implementations are likely to make the time delay
   a configurable, a suggested default is 2 seconds.
--
Darren J Moffat

---

From: Martin Forssen <[email-masked]>
Date: Tue, 19 Dec 2000 09:26:47 +0100 (MET)

On 18 Dec, Darren Moffat wrote:
> I think this is an implementation detail and many implementations
> would want to make this a tuneable value, I don't think the draft
> should put a lower bound on this of 2 seconds.   I would rather the
> text said:
> 
>    If the server intends to respond with a failure message, it MAY
>    delay for an implementation dependant time before sending to the
>    client. It is suspected that implementations are likely to make the
>    time delay a configurable, a suggested default is 2 seconds.

I think I stole this almost verbatim from the userauth draft, but I can
not find anything like that in the current versions of that draft. I
have no problems with making this change.

	/MaF