Subject: [nfsv4] RPCSEC_GSSv3 and muti-principal authentication

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 25 Jul 2014 10:01:03 -0400 (EDT)

Since we were having trouble channeling jabber into the meeting, let me 
try to say something using more words, here.

Andy had mentioned looking at the AFS "CombineTokens" operation from 
draft-wilkinson-afs3-rxgk-11 (which is great; trying to find prior art and 
not replicate other peoples' mistakes and all).  However, that document is 
something of a skeleton for how to use rxgk (i.e., not necessarily for 
AFS).  The actual concrete bits for using rxgk with AFS in particular, are 
in draft-wilkinson-afs3-rxgk-afs.  In particular, the plain 
"CombineTokens" operation is not currently very useful for AFS.  Instead, 
we define a similar operation, "AFSCombineTokens", which does the same 
sort of key mixing, but has a different behavior with repsect to 
identities.  This new AFSCombineTokens operation explicitly has a 
separation between "the user's identity" and "the identity of the 
machine/client acting on behalf of the user".  This lets the user's 
identity be used for filesystem access checks while avoiding the cache 
poisoning attacks that would be possible if just the user's credential was 
used directly.

I'm not sure that any of this is directly relevant for RPCSEC_GSSv3; I 
just wanted to point out that if Adam is looking for prior art, the 
problem AFSCombineTokens is trying to solve is closer to the problem that 
RPCSEC_GSS multi-principal authentication is trying to solve than the 
plain rxgk CombineTokens is.

Hopefully that makes sense.

-Ben

---

From: "faibish, sorin" <[email-masked]>
Date: Fri, 25 Jul 2014 10:29:56 -0400

Thanks for the notes Ben.

./Sorin

Sent from my iPad

> On Jul 25, 2014, at 10:02 AM, "Benjamin Kaduk" <[email-masked]> wrote:
> 
> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nfsv4