Subject: RE: comments on krb-dns-locate draft

From: Jeffrey Altman <[email-masked]>
Date: Wed, 8 Dec 99 14:08:12 EST

> This is a slight oversimplification, but if one wants service
> authentication, then what needs to be authenticated is "what the user types"
> (or picks via a UI), not something looked up in an insecure database. 
> 
> In the case above, the client should ask for a ticket for
> "host/name.foo.com". The clients wants the KDCs assurance that they are
> talking to the name they uttered.
> 
> (One can also use trustworty local information to map what the user types
> into the service name.)

Except that this is not how it works.  If I say that I want to 

  telnet cunix.cc.columbia.edu

what I will really get is a connection to one of the seven hosts whose
alias is cunix.cc.columbia.edu.  In order to find out which host I
need to retrieve a ticket for I must perform a reverse DNS lookup on
the IP address that I made the connection to.  It is only with this
name that I am able to then request a service ticket for

  host/[email-masked]

The same is true for X.509 certificates.  I can't perform a
verification of the certificate based upon the name the user types.
The name must be verified against the result of the reverse DNS
lookup because there can only be one reverse lookup name and there can
only be one name in a certificate.  Hence, they must both match.

The reality is that we need DNSSEC.  Too much of the security
infrastructure is based upon the use of names without a mechansism for
verifying the validity of the names we are using.

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Jonathan Trostle <[email-masked]>
Date: Wed, 08 Dec 1999 17:17:40 -0800

>  host/[email-masked]

Assuming that all seven servers are in the same realm, the client doesn't
care which of the seven it talks to, one solution which fits in well with
our proposal and results in minimal changes to your code here is to use a
multi component principal name (mentioned by Paul Leach) of the form:
host/sawasdee.cc.columbia.edu/cunix.cc.columbia.edu
The KDC can lookup up this name in the name database and return the correct
realm. 
Jonathan