Changing size of krb5_data's length member

[Sam Hartman]

Currently Kerberos 1.3 uses the same ABI on Unix as the Kerberos 1.2
series.  

It is our intent to commit to an ABI for Unix with the 1.3 release.
We are wondering whether we should change the size of krb5_data.length
from an unsigned 32-bit length to a size_t.  If we do make this
change, we would change a few other length fields as well.

The initial advantage of this seemed to be support for encrypting
large segments of data (> 4G) into a single encrypteddata PDU.  After
thinking about this, we believe that  if you are encrypting data that
large, you probably want  some API that allows streaming and possible
parallelism.  As such, it is not clear that there is a significant
benefit to being able to support greater than 32-bits for krb5_data.

Ken Raeburn is concerned that there may be security implications if
krb5_data has a 32-bit length and some applications have a 64-bit
length.  So far we have not actually found such an implication but are
still searching.


We are seeking input on this change.  We currently believe that unless
we find specific advantages for the change, preserving ABI
compatibility with released code is better than changing the lengths
of fields in krb5_data.

--Sam