Subject: Re: comments on krb-dns-locate draft

From: Derek Atkins <[email-masked]>
Date: 20 Dec 1999 10:06:19 -0500

"Paul Leach (Exchange)" <[email-masked]> writes:

> TLS does not depend on DNS security to do server authentication. Neither
> does it depend on its A records to be correct for anything but preventing
> DOS attacks. It does require that an FQDN be produced to compare against the
> one in the certificate supplied by the server.

TLS, as it is used today, can also assume a hostname of www.FOO.com.
If I type 'foo' into my browser, it will try a local machine of 'foo'
and then, if that fails, try the hostname 'www.foo.com'.  Indeed, I
just tried typing 'https://ted-williams', which for me resolves to
'ted-williams.mit.edu', and SSL accepted it.  I got connected without
an error.  As a ghedhanken experiment, what would happen if I had a
'ted-williams.foo.com' and had both foo.com and mit.edu in my search
path?  Would this still be considered a DOS attack?  What about if
only mit.edu was in the search path, but the DNS request pointed to a
machine that identified itself as 'ted-williams.foo.com'?  What would
happen then?

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/      PP-ASEL      N1NWH
       [email-masked]                        PGP key available
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: "Paul Leach (Exchange)" <[email-masked]>
Date: Mon, 20 Dec 1999 02:01:31 -0800

> -----Original Message-----
> From: Jeffrey Altman [mailto:[email-masked]]
> Sent: Friday, December 17, 1999 11:00 PM
> To: Paul Leach (Exchange)
> Cc: Jonathan Trostle; Derek Atkins; 'Ken Hornstein';
> [email-masked]
> Subject: RE: comments on krb-dns-locate draft
> 
> 
> Just one more comment:
> 
> all of the statements are making the assumption that the application
> knows before it makes the connection that it is going to use Kerberos
> for authentication.
> 
> In the case of Telnet, TLS, SSH, GSS-API, ... the application does not
> necessarily know that it is going to be using Kerberos to authenticate
> to the host until after the host is connected to AND the host requests
> that the application authenticate the user with a particular type of
> authentication (or cipher suite.)
> 
> In these environments where multiple authentication methods are
> supported DNS must be used by the application to determine who it is
> going to connect to.

Paul