Subject: Pkinit -23 comment: InitialVerifiedCAs *always* wrapped in AD-IF-RELEVANT

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Sun, 6 Feb 2005 19:51:20 -0800

From clarifications:

   Implementation note: Many RFC 1510 implementations ignore unknown
   authorization data elements. Depending on these implementations to
   honor authorization data restrictions may create a security weakness.

Unless there is significant benefit causing deployed server applications
to fail when PKINIT is used, we propose to always wrap this auth-data in
the AD-IF-RELEVANT container.

Any comments?

Thanks,

-- Larry

---

From: Nicolas Williams <[email-masked]>
Date: Sun, 6 Feb 2005 22:14:42 -0600

> the AD-IF-RELEVANT container.

We long ago decided that AD-INITIAL-VERIFIED-CAS is *critical* (as
critical as the 'transited' field of Ticket).

So, no, I don't agree to this change at this late stage.

I would agree to a MAY though: the TGS MAY wrap AD-INITIAL-VERIFIED-CAS
in an AD-IF-RELEVANT authorization-data element.  I'm not sure that such
text is at all needed though -- who will complain if a KDC
implementation supports wrapping, or excluding AD-INITIAL-VERIFIED-CAS
on a per-service principal basis?

If direction need be given as to when it's ok to wrap it then I'd
propose: "The TGS MAY wrap AD-INITIAL-VERIFIED-CAS in an AD-IF-RELEVANT
authorization-data container elmenent, or exclude it all together, if:
a) the KDC knows a priori that the ticket's service principal does not
implement support for AD-INITIAL-VERIFIED-CAS, b) the ticket's service
principal is not a cross-realm TGS principal name, and c) realm policy
on PKINIT client certificate validation paths is sufficient."

Also, I'm not sure that I would agree that KDCs should or must be
configurable in this regard.

But really, though I might want to implement such a feature I'm not sure
we need the spec to say a word about it.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Mon, 07 Feb 2005 17:27:31 -0500

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> On Sun, Feb 06, 2005 at 07:51:20PM -0800, Liqiang(Larry)
    Nicolas> Zhu wrote:
    >>  From clarifications:
    >> 
    >> Implementation note: Many RFC 1510 implementations ignore
    >> unknown authorization data elements. Depending on these
    >> implementations to honor authorization data restrictions may
    >> create a security weakness.
    >> 
    >> Unless there is significant benefit causing deployed server
    >> applications to fail when PKINIT is used, we propose to always
    >> wrap this auth-data in the AD-IF-RELEVANT container.
    >> 
    >> Any comments?

    Nicolas> We long ago decided that AD-INITIAL-VERIFIED-CAS is
    Nicolas> *critical* (as critical as the 'transited' field of
    Nicolas> Ticket).

Hmm, I thought that if the KDC believed it was critical then it did
not wrap it.  If the KDC had done its own policy check then it was not
critical (as in transited data with tp-policy-checked flag) and
wrapping is OK.

So I disagree with Larry's text although I agree with Larry that most
implementations will want to wrap it.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 7 Feb 2005 16:29:43 -0600

> critical (as in transited data with tp-policy-checked flag) and

That's implied in what I said: "as critical as the 'transited' field of
Ticket."

> implementations will want to wrap it.

Yes.  Larry's proposed some text that makes it clear that the decision
to wrap/unwrap AD-INITIAL-VERIFIED-CAS in AD-IF-RELEVANT is to be made
by each TGS in an x-realm path, which is akin to setting/resetting
TRANSITED-POLICY-CHECKED.  I agree to that; I don't agree to Larry's
initial proposal.

Nico
--