Subject: Re: comments on krb-dns-locate draft

From: Ken Hornstein <[email-masked]>
Date: Fri, 10 Dec 1999 17:13:45 -0500

>Sure the client uses DNS to get the IP address of the service, but it
>doesn't use it to do service authentication. Hence, if DNS is spoofed, the
>client might send a service ticket to the wrong server, but it won't be able
>to authenticate as the real server, because it won't know the real server's
>key.

But in Jonathan's example, he showed the service name being constructed from
DNS replies.  Under the model _you_ described, that's forbidden.  Is it
possible to do what he was describing without using DNS to construct the
service names?

>> The "primary" name in this example is determined by the IN-ADDR
>> lookup from the IP address returned from the original name A record,
>> right?
>
>No. It would come from the name of the Telnet service typed by the user.

Ah, I was going by Jonathan's example, where he said:

>It does the DNS lookup, finds out that it's an alias. On the reverse
>lookup, it picks up the primary name. So it knows how to construct the name.

--Ken
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: "Paul Leach (Exchange)" <[email-masked]>
Date: Fri, 10 Dec 1999 12:53:52 -0800

> -----Original Message-----
> From: Ken Hornstein [mailto:[email-masked]]
> Sent: Thursday, December 09, 1999 9:45 PM
> To: Jonathan Trostle
> Cc: [email-masked]
> Subject: Re: comments on krb-dns-locate draft 
> 
> 
> >At 02:22 PM 12/9/99 -0500, Ken Hornstein wrote:
> >>>>And how is application supposed to know to request that name?
> >>>
> >>Whoah, wait a second .... I thought under krb-referrals, 
> you aren't supposed
> >>to do DNS lookups anymore to construct service names.  Now 
> you're saying
> >>that the client still needs to use DNS?

> >
> >Here we are combining the user input with DNS lookup to construct the
> >service name. Since DNS is involved in name construction, 
> the client could
> >be redirected (by an attacker) to one of the other 7 
> servers, but we are
> >assuming the client doesn't care which of the 7 servers it talks to.
> 
> Oh, wait, one of my other replies just started me thinking ...
>