Subject: RE: Proposed Changes to PKINIT

From: "Friedrichs, Paul LCDR" <[email-masked]>
Date: Fri, 23 Feb 2001 19:49:53 -0500

Matt,

> -----Original Message-----
> From: Matthew Hur [mailto:[email-masked]]
.........
> 
> I am a bit confused by the desire to have the client decide 
> to pass another 
> realm to the KDC.  It does not serve a purpose with respect to 
> authenticating the client.

It's to allow the local KDC to discover the visiting user's home KDC. 

> In PKINIT, the client realm is that of the CA that issued the 
> certificate. 

I guess this doesn't pertain to the question at hand, but why must CAs be
linked to KDC realms?

> The SubjectAltName in the certificate is an 
> alternate name 
> that the CA associates with the client.  The KDC may make a 
> local policy 
> decision to map the client to a name within its local realm.

Perhaps I misunderstand, but isn't this "local" policy that of the KDC to
which the traveling user authenticates (and isn't this KDC the one that
manages the user's account), not the one nearest to the client used to
logon? If this is the case, then  it appears consistent to me that this is
only a question of discovery for the local KDC. 

> I am ok with the KDC making local policy decisions (i.e. 
> mapping the client 
> name/realm).  I am not ok with allowing the client to specify 
> a client 
> realm that is different from the realm that is in its authentication 
> credentials. 

Possibly not changing your argument: I'm proposing that there would be no
realm in the credential.

I'm confused by the below example. I don't see how exchanges that occur
before a TGT is provided to the user could be comparable to how TGTs are
used afterward. If I am C, whose account is in 1, but I am logging on within
2, isn't it 1 that initially authenticates me? Let's say this was just
USERID and password. Wouldn't I have to type in my realm if I were a visitor
from another location? (I do this all the time.) Isn't Kerberos relying on
nothing other than the string I typed in to find the KDC that can
authenticate me using the USERID and password? (Again, perhaps I have
misunderstood how this works.) If so, why is it necessary that the realm be
in the certificate?

> An analogous example would be using non-PK 
> Kerberos.  Say you 
> have a client C and two realms 1 and 2.  C gets a cross realm 
> TGT from 
> realm 1 for realm 2.  C requests a ticket from realm 2 by 
> sending the cross 
> realm TGT, but C adds something to the request to say "hey, 
> I'm not really 
> C in realm 1, I'm really someone else".  This is obviously 
> the wrong thing 
> to do.  Yet this is equivalent to what we would be doing if 
> the client 
> could tell the KDC that it is in a different realm than the 
> one specified 
> in its authentication credentials.  Note that there is a 
> difference between 
> realm 1 specifying information about C and C specifying 
> information about 
> itself, because the cross realm trust relationship is between 
> realm 2 and 
> realm 1, not between realm 2 and C.

Again, my understand is that C would tell 2 that 1 can authentic C. 1
authenticates C and issues the TGT. 2 trusts 1's TGT. Am I off base?

Thanks Again,

Paul

---

From: "Douglas E. Engert" <[email-masked]>
Date: Sat, 24 Feb 2001 17:54:19 -0600

May I make a few comments here? 

From what I can tell, DISA want to put an identity into the certificate.
This can then be used to derive a kerberos principal. 

But it sounds like DISA is assuming that this identity MUST be 
a Kerberos principal, as the PKINIT allows this to be a principal. 
(This is useful only if the CA and KDC are tightly coupled, and avoids
the KDC having to do a name mapping. But this is not the DISA case.)  

I think that this is the problem. In the DISA case, the identity
is not required to be a Kerberos principal. Each KDC that is
willing to accept the certificate can map the identity
into a kerberos principal locally.
 
Also if the certificate is used with kinit, the user can 
provide a principal name. This is then presented to the KDC
along with the certificate, and the KDC can then deiced to 
issue a ticket for the principal. This would allow the same 
certificate to be used with multiple principals. 

So I don't see the problem? Am I missing something?    

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444