Subject: Fwd: WGLC comments on draft-ietf-krb-wg-naming-03.txt

From: "Kevin Coffman" <[email-masked]>
Date: Thu, 5 Apr 2007 09:40:04 -0400

[Resending after re- re-subscribing...]

The heading lists the "NETWORK WORKING GROUP".  I see that rfc4120 was
published with the same thing, but shouldn't this be the "Kerberos
Working Group"?

There is a typo in the Abstract ("principal name" s/b "principal
names"), but Jeffrey's suggested rephrasing handles that.

Section 3.1 (and repeated in Section 3.2) has another typo:

   "and SHOULD reject the authentication attempt is a
   well-known principal name is used ..."

That should read "if a well-known..."

Also in Section 3.1 (and repeated in Section 3.2), I was confused by
the sentence, "Unless otherwise specified, if a well-known
[principal|realm] name is used but not supported in any other places
of Kerberos messages, authentication MUST fail".

I suggest rephrasing this to, "Unless otherwise specified, if a
well-known [principal|realm] name is used in any other Kerberos
message, but is not supported, authentication MUST fail."

K.C.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 05 Apr 2007 11:49:45 -0400

> published with the same thing, but shouldn't this be the "Kerberos

No; the heading is correct.  See <http://rfc-editor.org/rfcfaq.html#wg>

> message, but is not supported, authentication MUST fail."

The existing text does not just refer to other messages; it also covers 
other fields in the messages that are discussed.  I agree the sentence in 
question should be reworded, but I don't think your suggested phrasing 
captures this distinction.

-- Jeff

---

From: "Kevin Coffman" <[email-masked]>
Date: Thu, 5 Apr 2007 12:31:23 -0400

> captures this distinction.

OK, is either of these any better?

"If a well-known [principal|realm] name is used in any other field of
any other Kerberos message where its use is not explicitly specified,
authentication MUST fail."

"Unless support is specified elsewhere, if a well-known
[principal|realm] name appears in any other field of any other
Kerberos message, authentication MUST fail."

K.C.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 05 Apr 2007 12:38:51 -0400

> Kerberos message, authentication MUST fail."

Change "any other Kerberos message" to "any Kerberos message" (in two 
places), and I think we've got it.  Comments, anyone?

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 05 Apr 2007 12:40:17 -0400

> places), and I think we've got it.  Comments, anyone?

<sigh>; I was not reading carefully enough to notice that you were 
proposing two alternatives.  With the change, I'm fine with either one, 
with a very slight preference for the first.

I would like to hear from others on whether this is OK.

-- Jeff

---

From: "Aaron D. Jaggard" <[email-masked]>
Date: Thu, 5 Apr 2007 18:08:44 -0500

The security considerations include

"Care MUST be taken to avoid accidental reuse of names."

It's not clear how to decide whether an implementation is in
compliance with this requirement---how does one check if an
implementation is taking sufficient care about this?  I think
something like "Names SHOULD NOT be reused." would be better.
[Similar language is in the proposed text for
draft-ietf-krb-wg-anon-03.txt: section 4, paragraph 8 that was
circulated a couple weeks ago; a similar comment would apply.]

--Aaron