Subject: Preauth framework 6.4: mechanisms with challenges

From: Sam Hartman <[email-masked]>
Date: Tue, 17 Jul 2007 12:46:12 -0400

Section 6.4 discusses authentication sets.  
These are used when you have a set of mechanisms all of which must succeed.

One question is how to handle challenges from these mechanisms.
For example if SAM  is going to be used you want to collect the prompts.

Larry proposes that along side the authenitcation set element you have initial challenges from any padata types that need them.

I wonder if this is actually the right approach.

1) It seems hard to parse.  You need to know if a mechanism is part of
   an authentication set; if it is , then you don't process it immediately.  If it is not, you do.

2) It assumes that the challenge associated with a mechanism is
   independent of what other mechansims you are going to combine it
   with.

--Sam