Subject: Re: [Ietf-krb-wg] Benefits of using FAST in TGS

From: Larry Zhu <[email-masked]>
Date: Wed, 10 Jun 2009 08:05:54 +0000

Additionally it gives us the ability to hide the client name in the TGS reply. it is a big deal to have the ability to sign Kerberos errors.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Srinivas Cheruku
Sent: Wednesday, May 27, 2009 1:47 AM
To: 'Sam Hartman'
Cc: [email-masked]
Subject: [Ietf-krb-wg] Benefits of using FAST in TGS

Sam,

What are the big benefits of using FAST in TGS?

1.       In case of any error, KRB-ERROR data would be protected

2.       The request body is protected using FAST.

3.       The pre-auth data PA-TGS-REQ is outside fast. So, non-encrypted fields in AP-REQ are still vulnerable. Is there any big risk? Is this padata outside FAST for any interoperability reason with non FAST KDCs?

4.       Is there any other pre-auth data PA-TGS-REQ, that can be used in TGS-REQ and this can be protected by FAST?

Thanks,
Srini

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 10 Jun 2009 11:26:12 -0500

> 1.       In case of any error, KRB-ERROR data would be protected

This is crucial.

> 3.       The pre-auth data PA-TGS-REQ is outside fast. So, non-encrypted
> fields in AP-REQ are still vulnerable. Is there any big risk? Is this padata
> outside FAST for any interoperability reason with non FAST KDCs?

AP-REQ has very little cleartext, but, in any case, KrbFastArmoredReq's
req-checksum covers the PA-TGS-REQ.

> 4.       Is there any other pre-auth data PA-TGS-REQ, that can be used in
> TGS-REQ and this can be protected by FAST?

Good point.  Today the answer is no.  And with FAST the answer is that
any additional PA needed in some future TGS extension ought to go inside
FAST anyways.

Nico
--