Also, you say you wish to implement [MS-KKDCP] but then note: “Preliminary testing suggests that this is not what Microsoft uses, but the server isn't particularly chatty about errors.” The spec defines the request/response format as the KDC_PROXY_MESSAGE ASN.1 structure. -- Luke