>Yup. Didn't realize rfc4121 made it independent of >the mechanism though. I'll go back and read that. RFC 4121 makes it independent of the cryptosystem for the Kerberos GSS-API mechanism, ie. it leverages RFC 3961 (backwards compatibility nothwithstanding). -- Luke --