Subject: [Ietf-krb-wg] an inconsistency in draft-ietf-krb-wg-anon-05.txt

From: Larry Zhu <[email-masked]>
Date: Wed, 9 Apr 2008 13:25:00 -0700

When reading draft -05, I found the following inconsistency:

In section 2, it says"An anonymous Kerberos realm name MUST NOT be present in the transited field of a ticket."

In section 4, we have:

   The TGS MUST add the name of the previous realm according to Section
   3.3.3.2 of [RFC4120].  If the client's realm is the anonymous realm,
   the abbreviation forms that build on the preceding name cannot be
   used at the start of the transited encoding.  The null-subfield form
   (e.g., encoding ending with ",") could not be used next to the
   anonymous realm that can potentially be at the beginning where the
   client realm is filled in.

this alludes how to encode the anonymous realm name in the transited field. This text (the later) does not seem necessary.

unless there is anyone who can recall what the later text is for, I would propose to remove it, and replace it with the following text to clarify:

   The TGS encodes the name of the previous realm into the transited
   field according to Section 3.3.3.2 of [RFC4120].  Based on local
   policy, the TGS MAY omit the previous realm if the cross realm TGT is
   an anonymous one to hide the authentication path of the client.  The
   unordered set of realms in the transited field, if present, can
   reveal which realm may potentially be the realm of the client or the
   realm that issued the anonymous TGT.

-larry
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg