Subject: [Ietf-krb-wg] FAST: which kdc-req-body to use for other padat

From: Sam Hartman <[email-masked]>
Date: Fri, 30 Jan 2009 17:25:04 -0500

Apologies if I already wrote this up.
There is some ambiguity about what mechanisms such as pkinit should use when doing a checksum of the KDC-REQ-BODY.

I think the security implications are minimal.  The FAST request
encrypts and integrity protects such mechanisms together with the
inner KDC-REQ-BODY.
The FAST message includes a checksum of the outer KDC-REQ-BODY.

Cases where it might matter:
* You are doing FAST using anonymous pkinit to a man-in-the-middle who strips your FASTness and sends on the inner requests to the real KDC.
I think this is harmless.

* You are using anonymous PKINIT  for your armor ticket, but you have stronger authentication in the pa-data such as PKINIT itself.  

I still don't think it matters in these cases.  The attacker could
reasonably have the KDC-REQ-BODY match.

So, I need to make a decision and I'm fairly sure it doesn't matter
what I decide.  I've decided that padata should use the outer
KDC-REQ-BODY because that's what they are doing today.  This decision
probably has implications for implementation complexity.  I don't know
what they are.  I'm reasonably sure they are minor.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg