Subject: #22

From: Shoichi Sakane <[email-masked]>
Date: Fri, 04 Feb 2005 21:11:05 +0900

> #22 [*] Kerberos PFS (section 6.8)
> 
> 	Sec 6.8: "Kerberos in general does not provide PFS so it is somewhat 
> 	questionable whether a system which is heavily relying on Kerberos 
> 	benefits from PFS."  First, that sounds like it might be Security 
> 	Considerations material.  Second, I don't follow; explain please?
> 	(Ken Raeburn)

I agree with Ken about the first.  the document has to describe this
issue in the security consideration even if the thing is not issue,
at least, the document says that is questionable.

I don't understand what Ken meant.  what don't you follow ?

---

From: Michael Thomas <[email-masked]>
Date: Fri, 04 Feb 2005 06:15:30 -0800

> I don't understand what Ken meant.  what don't you follow ?

Well, it's pretty simple really: when you get tickets from
the KDC, they aren't protected by PFS so using PFS later
is pretty questionable. It's not useless, but it's not any
huge win either. Until Kerberos itself supports PFS, people
deploying KINK really ought not get worked up into a lather
about turning on PFS to improve security since it's doesn't
to any great degree.

		Mike

---

From: Sam Hartman <[email-masked]>
Date: Tue, 08 Feb 2005 16:24:52 -0500

>>>>> "Michael" == Michael Thomas <[email-masked]> writes:

    Michael> Well, it's pretty simple really: when you get tickets
    Michael> from the KDC, they aren't protected by PFS so using PFS
    Michael> later is pretty questionable. It's not useless, but it's
    Michael> not any huge win either. Until Kerberos itself supports
    Michael> PFS, people deploying KINK really ought not get worked up
    Michael> into a lather about turning on PFS to improve security
    Michael> since it's doesn't to any great degree.

I'm confused.  I thought the point of PFS was to make it impossible to
recover session data .  How does the fact that the KDC does not do PFS
decrease the value of PFS for Kink?

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 08 Feb 2005 16:48:57 -0500

> decrease the value of PFS for Kink?

I'm also confused by Michael's remarks, but, as I recall, one of the 
motivations for KINK was to do IPsec SA setup with lower CPU overhead
by avoiding public key operations.   If you add in a D-H exchange for PFS, 
you blow away that motivation and this winds up looking like a strange
way to build a GSS-authenticated IKE..

						- Bill

---

From: Michael Thomas <[email-masked]>
Date: Tue, 08 Feb 2005 15:17:29 -0800

> way to build a GSS-authenticated IKE..

This all comes down to what constitutes a "session". I'd
argue that it would be a lot better if Kerberos "sessions" (ie, tickets
and their lifetimes) provided the notion of PFS since 
that would cover every protocol that implements kerberos
authentication instead of the piecemeal approach that 
each kerberos application needs to deal with PFS itself. 
That and the place that I'd think you _really_ want PFS
is for the AS-REQ/AS-REP since that's where the most
vulnerable piece of information is exchanged (ie, the
password). 

In fact, I'd be willing to wager that KINK is the _only_ 
Kerberized application that has any notion of PFS right now
which really illustrates why if people think that PFS is
important, it ought to be done up a level.

But.. we are where we are. If the editorial comment is 
really causing mass hysteria, then we should just take
it out because it doesn't affect anything about KINK.

		Mike

---

From: Ken Raeburn <[email-masked]>
Date: Tue, 8 Feb 2005 18:51:20 -0500

> each kerberos application needs to deal with PFS itself.

There's been talk occasionally about doing this.  We've had to fix up 
some problems in the basic protocol spec first, though, and that's been 
taking too long.

> vulnerable piece of information is exchanged (ie, the

Well, the password is not sent, but yes, the AS exchange is the obvious 
place to start.  Various preauthentication schemes should be able to 
add PFS easily, if desired, and at least one has been proposed.

Ken

---

From: Sam Hartman <[email-masked]>
Date: Tue, 08 Feb 2005 22:57:46 -0500

>>>>> "Michael" == Michael Thomas <[email-masked]> writes:

    Michael> In fact, I'd be willing to wager that KINK is the _only_
    Michael> Kerberized application that has any notion of PFS right
    Michael> now which really illustrates why if people think that PFS
    Michael> is important, it ought to be done up a level.

You'd lose the wager; the GSSAPI support for ssh does PFS.

I do agree PFS should be supported at a higher level in Kerberos
though; that is on krb-wg's agenda to enable.

--Sam

---

From: "KAMADA Ken'ichi" <[email-masked]>
Date: Wed, 09 Feb 2005 13:10:43 +0900

At Tue, 08 Feb 2005 16:48:57 -0500,
> way to build a GSS-authenticated IKE..

I agree with Michael that PFS should be provided by Kerberos.
On the other hand, I also agree with Sam and Bill that PFS provided
by KINK has more-than-nominal values.

The issue here is the tradeoff between PFS and low computational cost.
Thinking on the motivation of KINK, which reduce computational cost
to exchange SAs, taking low CPU power at the cost of PFS is
reasonable to me.
So I'd propose an editorial change to the phrase
"it is somewhat questionable whether a system which is heavily
relying on Kerberos benefits from PFS."

-- 
KAMADA Ken'ichi <[email-masked]>

---

From: Sam Hartman <[email-masked]>
Date: Wed, 09 Feb 2005 21:23:05 -0500

As I understand it, currently Kink provides PFS as an optional
feature.

That seems fine to me.  Not providing PFS also seems fine if the WG
wants to go that route.

I was just trying to understand what the text meant.

--Sam