Subject: [Ietf-krb-wg] Last Call Comments: draft-ietf-krb-wg-anonymous-05.txt

From: Sam Hartman <[email-masked]>
Date: Mon, 7 Apr 2008 14:43:03 -0400 (EDT)

I was reviewing a design for an ibmplementation for part of this draft
and ran across additional issues beyond what I brought up in my
previous last call comments.  I'm still waiting for a response to
those comments.  Ken raeburn will be filing comments within the next
day or so discussing interactings between this draft and RFC 2743 and
2744.

If I use pkinit for an anonymous AS request, what should the client
realm be.  As I read the draft, the only valid answer is the anonymous
realm.  However as Ken Raeburn read the draft, the KDC could use
either its realm name or the realm name of the anonymous realm.  I had
assumed that you only got the realm name of the KDC or client in cases
where TGS requests were used to get anonymous tickets.

How should anonymous realms interact with cross-realm policy?  The
draft discusses how they are encoded but not what policies are
reasonable.  This affects interoperability.  Consider two
implementations.  The first gets an anonymous ticket from the KDC
closest to the server.  Servers from implementations one assume that
the cross-realm path from the anonymous realm will be empty because
that's how their implementation works and because security is
decreased by additional intermediate trusted parties.  The second
implementation starts with the KDC where the local machine is
registered.  Its servers use normal cross-realm policy logic and
assume that anyone can be on the cross-realm path between the
anonymous realm and the server.  Implementation two takes advantage of
referrals to find the server's realm even in the anonymous case.
However these two implementations cannot interoperate because they
have incompatible policies for validating cross-realm paths.  Thus,
this issue is a valid subject for standardization.

In the anonymous AS request, there are two implementation issues we've
noticed.  The first is which KDC do you contact for the anonymous
ticket?  The second is that you need to keep track somewhere in your
credential cache what KDC you talked to so you can select the right
ticket.  The second issue should be mentioned in the draft but we
probably don't want to give requirements for solutions; that is an
implementation matter.  The first issue may be something where advice
is useful.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg