Subject: Re: [Ietf-krb-wg] WG Last Call: draft-ietf-krb-wg-cross-problem-statement-01.txt

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 23 Jan 2008 15:01:06 -0500

--On Thursday, December 06, 2007 09:12:54 PM +0900 Saber Zrelli 
<[email-masked]> wrote:

> But in general, concerning PKI based
> solutions, IMO the CA would only sign your KDC certificate. Since you
> will be the unique owner of the private key, even the CA can not
> impersonate your KDC. However this may need further analysis as you said.

I feel compelled to point out that this is not true.  The CA can 
impersonate your KDC by generating itself a key pair and issuing a 
certificate saying that its public key belongs to your KDC.

-- Jeff
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: "Saber Zrelli" <[email-masked]>
Date: Thu, 24 Jan 2008 06:18:49 +0900 (JST)

Hello Jeff,

>>>Finishing and deploying PKCROSS doesn't solve this problem, it only moves it. In a
>>>hypothetical PKCROSS world, the certificate authorities that are used to establish
>>>trust between realms can impersonate any client in any realm that they are the basis
>>>for trust with. I believe that such an entity could even conduct a MITM attack and
>>>learn the session key, but I don't have the right background to try and prove it.

>> This ID is not promoting PKCROSS. But in general, concerning PKI based

I agree with you.

What I meant is that in the context of MiTM, it is not possible for the CA to
impersonate the KDC during an ongoing session authentication session based on public-key
cryptography without breaking basic assumptions.

IMO public key based cross-realm protocols should be safe against MiTM attacks but as
you said not against impersonated/rogue KDCs.

--Saber