Subject: Re: [kitten] Comments on draft-ietf-krb-wg-camac-08

From: Tom Yu <[email-masked]>
Date: Fri, 01 Aug 2014 12:54:38 -0400

Greg Hudson <[email-masked]> writes:

> My preference is to:
>
> * Advise that CAMMACs be put inside AD-IF-RELEVANT.
>
> * Specify that authdata contained within a CAMMAC should be considered
> non-critical.  (That is, you don't have to wrap everything inside a
> CAMMAC in AD-IF-RELEVANT.)  RFC 4120 already does this for AD-KDC-ISSUED
> (section 5.2.6.2, last paragraph), presumably under the assumption that
> it is used for positive rather than negative authdata.

I agree that AD-CAMMAC should have the same effect on the criticality of
its contents as AD-KDC-ISSUED.  We can recommend that a CAMMAC be put in
AD-IF-RELEVANT if it is likely that the consuming service won't
understand it.  The KDC might have enough knowledge of the capabilities
of the service that the extra layer of wrapping might not be necessary.

---

From: Nico Williams <[email-masked]>
Date: Fri, 1 Aug 2014 12:12:37 -0500

> of the service that the extra layer of wrapping might not be necessary.

I agree with this.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Fri, 01 Aug 2014 14:45:32 -0400

>>>>> "Nico" == Nico Williams <[email-masked]> writes:

    Nico> On Fri, Aug 1, 2014 at 11:54 AM, Tom Yu <[email-masked]> wrote:
    >> I agree that AD-CAMMAC should have the same effect on the
    >> criticality of its contents as AD-KDC-ISSUED.  We can recommend
    >> that a CAMMAC be put in AD-IF-RELEVANT if it is likely that the
    >> consuming service won't understand it.  The KDC might have enough
    >> knowledge of the capabilities of the service that the extra layer
    >> of wrapping might not be necessary.

    Nico> I agree with this.

I'm fine with this too.

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 1 Aug 2014 22:53:08 -0400 (EDT)

>    >> of wrapping might not be necessary.

I'm glad to see lots of people chiming in with agreement, but are we all 
clear on what we're agreeing to?

Are we accepting Greg's reading of 4120 section 5.2.6.2, "This element and 
the elements it encapsulates MAY safely be ignored by applications, 
application servers, and KDCs that do not implement this element."

-Ben

---

From: Nico Williams <[email-masked]>
Date: Fri, 1 Aug 2014 22:29:51 -0500

On Fri, Aug 01, 2014 at 10:53:08PM -0400, Benjamin Kaduk wrote:
> I'm glad to see lots of people chiming in with agreement, but are we
> all clear on what we're agreeing to?
> 
> Are we accepting Greg's reading of 4120 section 5.2.6.2, "This
> element and the elements it encapsulates MAY safely be ignored by
> applications, application servers, and KDCs that do not implement
> this element."

Oh, hmmm.  Will anyone ever want to include critical elements in a
CAMMAC?  If so then CAMMAC would need a way to signal that, or it'd have
to be permitted to be critical itself.

Maybe it really is time to revisit criticality...  Maybe we just can't
get it.

---

From: Tom Yu <[email-masked]>
Date: Thu, 28 Aug 2014 14:36:33 -0400

Sam Hartman <[email-masked]> writes:

> My recommendation is that we move the authorization data registry from
> Kerberos IANA to section 6 here and remove section 5.
> I feel reasonably strongly that publishing this document without either
> an IETF consumer or an IANA registry is bad.

I believe the recently revived draft-jain-kitten-krb-auth-indicator-01
should satisfy your "IETF consumer" requirement, if the WG adopts it.