receive packet; if (packet.pvno != 5) then either process using other protocol spec or error_out(KRB_AP_ERR_BADVERSION); endif if (packet.msg-type != KRB_CRED) then error_out(KRB_AP_ERR_MSG_TYPE); endif cleartext := decrypt(packet.enc-part) using negotiated key; if (decryption_error()) then error_out(KRB_AP_ERR_BAD_INTEGRITY); endif if ((packet.r-address is present or required) and (packet.s-address != O/S_sender(packet)) then /* O/S report of sender not who claims to have sent it */ error_out(KRB_AP_ERR_BADADDR); endif if ((packet.r-address is present) and (packet.r-address != local_host_address)) then /* was not sent to proper place */ error_out(KRB_AP_ERR_BADADDR); endif if (not in_clock_skew(packet.timestamp,packet.usec)) then error_out(KRB_AP_ERR_SKEW); endif if (repeated(packet.timestamp,packet.usec,packet.s-address)) then error_out(KRB_AP_ERR_REPEAT); endif if (packet.nonce is required or present) and (packet.nonce != expected-nonce) then error_out(KRB_AP_ERR_MODIFIED); endif for (ticket[n] in tickets that were forwarded) do save_for_later(ticket[n],key[n],principal[n], server[n],times[n],flags[n]); return