Subject: more draft-ietf-krb-wg-kerberos-set-passwd-00.txt comments

From: "Joel N. Weber II" <[email-masked]>
Date: Sat, 12 Jul 2003 16:23:02 -0400

Security considerations should explicitly explain whether replay
attacks are possible.  Sequence numbers when using TCP are probably
sufficient to prevent replays, but with UDP you probably need a replay
cache.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 14 Jul 2003 07:43:10 -0700

> sufficient to prevent replays, but with UDP you probably need a replay

Why?  draft-ietf-krb-wg-kerberos-set-passwd-00.txt uses Kerberos
messages, AP-REQ, AP-REP and KRB-PRIV - it's Kerberos' responsibility to
ensure that there are no replays.

The text requires the use of mutual authentication and requires the use
of sequence numbers when used over TCP (but not when used over UDP).

Cheers,

Nico
--

---

From: "Joel N. Weber II" <[email-masked]>
Date: Mon, 14 Jul 2003 11:38:58 -0400

> ensure that there are no replays.

Thinking about it a bit, I think you're right.  The important point is
that the spec for the layer that prevents replays says that that layer
prevents replays, and clarifications already says more or less that
sequence numbers used in this fashion are sufficient to prevent
replays.