Subject: Re: [kitten] CAMMAC review comments

From: Peter Mogensen <[email-masked]>
Date: Fri, 01 Aug 2014 09:54:25 +0200

On 2014-07-31 21:00, Simo Sorce wrote:
> I think the kdc-verifier could be made optional, though I am not sure
> why anyone would go through the trouble of disabling it using complex
> heuristics to save a few bytes unless the CAMMAC payload is very small.

Referencing our earlier discussion about how to make everything simpler 
and smaller (and why that was not easy withing the framework of RFC4120).

Small CAMMAC payloads will not be rare. If you have a plain ticket 
without authdata and only need to add RFC6806 NT-ENTERPRISE 
capabilities, then protecting AD-LOGIN-ALIAS which can easily be around 
just 10 bytes, will have a checksum around 100 bytes. (*)

Putting a few of those tickets in - say - an HTTP cookie will add 
considerably to the HTTP header size.  (HTTP/2.0 would help a lot then)

I don't think one should underestimate the value of small tickets.

/Peter

*: I know RFC6806 explicitly calls for AD-KDC-ISSUED, but one could 
easily imagine wanting to protect AD-LOGIN-ALIAS through S4U2proxy 
delegation too.