Subject: [Ietf-krb-wg] OTP draft - PIN change service

From: "Srinivas Cheruku" <[email-masked]>
Date: Mon, 22 Jun 2009 16:29:37 +0530

Hi,

>From OTP draft,

   In the user is required to change their PIN then it is recommended
   that user PIN change be handled by a PIN-change service supporting

   the ChangePasswdData in a AP-REQ as described in [
<http://tools.ietf.org/html/rfc3244> RFC3244].  

Just saying as above will not suffice as there are issues which needs to be
addressed for PIN change service are:

    1) A standard port needs to be defined for the PIN change service or at
least a way for the current RFC3244 password change service to distinguish
between PIN and Kerberos password changes

    2) The PIN change service would need a way of telling which token of the
user is having its PIN change

    3) Related to issue 2, the PIN change service would need to be able to
determine which OTP-server is handling the token(Multiple OTP servers can be
used in an organization).

Thanks,
Srini

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: <[email-masked]>
Date: Tue, 30 Jun 2009 13:08:59 -0400

Srini,

It looks as if you are right.  

I had assumed that PIN change would either be handled using an existing
mechanism that was already in place for the token type or via a "PIN
Change Service" as described in the extract.  Since PIN change is
similar to password change, I had hoped that this could be handled using
the existing Kerberos password change system but it seems as if that was
a mistake.  Overloading an existing protocol is probably not a good idea
and I had not taken into account the fact that a user could have
multiple tokens or that multiple back-end OTP servers could be involved.

There are three main problems with the current approach:

1) The existing ChangePasswordData in RFC3244 does not appear to support
a way for the client to inform the service which token needs to have its
PIN changed.  

2) Generally, the client wouldn't even know which token the user
happened used and so wouldn't have the information to provide anyway.

3) Since the KDC would not generally be the OTP server itself, the KDC
itself cannot be assumed to have the information required to change the
PIN either.

With hindsight, it seems that it would probably be better if the OTP
pre-authentication draft leaves the actual method of PIN change out of
scope in the same way that I believe RFC4120 does not describe how to
carry out password change.  This would then leave it open for a separate
PIN change protocol. 

So I suggest re-wording section 2.3 to remove mention of RFC3244.

--Gareth

________________________________

	From: Srinivas Cheruku [mailto:[email-masked]] 
	Sent: 22 June 2009 12:00
	To: Richards, Gareth; [email-masked]
	Subject: OTP draft - PIN change service

	Hi,

	From OTP draft,

	   In the user is required to change their PIN then it is
recommended
	   that user PIN change be handled by a PIN-change service
supporting

	   the ChangePasswdData in a AP-REQ as described in [RFC3244
<http://tools.ietf.org/html/rfc3244> ].  

	Just saying as above will not suffice as there are issues which
needs to be addressed for PIN change service are:

	    1) A standard port needs to be defined for the PIN change
service or at least a way for the current RFC3244 password change
service to distinguish between PIN and Kerberos password changes

	    2) The PIN change service would need a way of telling which
token of the user is having its PIN change

	    3) Related to issue 2, the PIN change service would need to
be able to determine which OTP-server is handling the token(Multiple OTP
servers can be used in an organization).

	Thanks,
	Srini