Subject: Re: comments on krb-dns-locate draft

From: Ken Hornstein <[email-masked]>
Date: Fri, 10 Dec 1999 17:41:52 -0500

>I can say that there is nothing that precludes an MIT KDC from doing so --
>the spec is complete enough to permit an implementation.

Okay, I looked at draft-ietf-cat-kerberos-revisions-04, and the only
thing I could find on naming was the following footnote:

[15]This can be accomplished in several ways. It might be known beforehand
(since the realm is part of the principal identifier), it might be stored in
a nameserver, or it might be obtained from a configura- tion file. If the
realm to be used is obtained from a nameserver, there is a danger of being
spoofed if the nameservice providing the realm name is not authenti- cated.
This might result in the use of a realm which has been compromised, and
would result in an attacker's ability to compromise the authentication of
the application server to the client.

Which really doesn't say anything about a protocol extension.

Which bits of 1510bis are you referring to exactly?

--Ken
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: "Paul Leach (Exchange)" <[email-masked]>
Date: Fri, 10 Dec 1999 14:24:08 -0800

> -----Original Message-----
> From: Ken Hornstein [mailto:[email-masked]]
> Sent: Thursday, December 09, 1999 9:38 PM
> 
> >The main focus of the "canonicalization" proposal is that, whatever
> >mechanism one uses, it is easier to manage by keeping it on the KDCs.
> 
> Uh, perhaps I wasn't clear.  I'm not talking about the 
> proposed protocol
> changes at this point.  You said in a previous piece of email (and I
> quote):
> 
> >Well, an implementation that does not depend on DNS security is
> >already in fairly wide use -- a 100's of thousands of copies. Soon
> >to be millions.
> >
> >And it depends on nothing not in the 1510bis draft. 
> 
> So my interpretation of this statement is that the MS Kerberos
> implementation does not have any security dependencies on DNS,

Correct.

> and that I can take my Windows 2000 client and plunk it down in my
> network where I'm running a MIT KDC, and it will work fine without
> any of the security problems we've been discussing to death.

I do not know that any shipping MIT KDC implements the needed piece of the
1510bis draft -- but that's a statement made in complete ignorance. 

I can say that there is nothing that precludes an MIT KDC from doing so --
the spec is complete enough to permit an implementation.
I in fact suggested an implementation -- use the mechanism that clients
currently use: use the krb5.conf file and look up the name and get the
associated realm.

If it did so, then indeed you "can take [your] Windows 2000 client and plunk
it down in [your]
network where [you're] running a MIT KDC, and it will work fine without
any of the security problems we've been discussing to death."

> 
> My questions are:
> 
> - Is my interpretation of your statement correct?
> - If my interpretation is correct, then how is name 
> canonicalization done?
>   Certainly it can't be using that untrusted DNS .... so how 
> does it do it?

All answered above, I hope.

Paul