Subject: RE: comments on krb-dns-locate draft

From: "Paul Leach (Exchange)" <[email-masked]>
Date: Thu, 9 Dec 1999 15:34:27 -0800

> -----Original Message-----
> From: Jeffrey Altman [mailto:[email-masked]]
> Sent: Thursday, December 09, 1999 2:33 PM

> 
> > >We do not depend on DNS security. We use the directory to 
> locate referrals -
> > >not DNS. DNS is only used to locate a KDC for a domain/realm.
> > 
> > Okay, I'm going to show my ignorance here ... _which_ 
> directory are we
> > talking about?
> > 
> > I guess the real question is, "How are hostnames 
> canonicalized?"  Is this
> > done via DNS?  The "directory"?  Is there a relationship 
> between the DNS
> > and the "directory"?
> 
> I assume that the MS folk are referring to their Active Directory.

Yes and no. The mechanism used to canonicalize the name is outside the scope
of the protocol. For example, a simple and already well understood way would
be to use, within the KDC, the same mechanism that _clients_ currently use
to map service names to realms. A complicated way is to use Active Directory
:-).

The main focus of the "canonicalization" proposal is that, whatever
mechanism one uses, it is easier to manage by keeping it on the KDCs.

Paul

---

From: Ken Hornstein <[email-masked]>
Date: Fri, 10 Dec 1999 00:37:45 -0500

>mechanism one uses, it is easier to manage by keeping it on the KDCs.

Uh, perhaps I wasn't clear.  I'm not talking about the proposed protocol
changes at this point.  You said in a previous piece of email (and I
quote):

>Well, an implementation that does not depend on DNS security is
>already in fairly wide use -- a 100's of thousands of copies. Soon
>to be millions.
>
>And it depends on nothing not in the 1510bis draft. 

So my interpretation of this statement is that the MS Kerberos
implementation does not have any security dependencies on DNS, and
that I can take my Windows 2000 client and plunk it down in my
network where I'm running a MIT KDC, and it will work fine without
any of the security problems we've been discussing to death.

My questions are:

- Is my interpretation of your statement correct?
- If my interpretation is correct, then how is name canonicalization done?
  Certainly it can't be using that untrusted DNS .... so how does it do it?

--Ken
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]