Subject: RE: Pkinit -23 comment: InitialVerifiedCAs *always* wrapped in AD-IF-RELEVANT

From: "Paul Leach" <[email-masked]>
Date: Mon, 7 Feb 2005 15:16:11 -0800

This does not tell me why it needs to be critical. As far as I can see,
as long as the KDC MUST put the info into the ticket under an
AD-IF-RELEVANT, then any application that wants an application specific
transit policy will be able to enforce one.

> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]] 
> Sent: Monday, February 07, 2005 10:29 AM
> To: Paul Leach
> Cc: [email-masked]
> Subject: Re: Pkinit -23 comment: InitialVerifiedCAs *always* 
> wrapped in AD-IF-RELEVANT
> 
> On Mon, Feb 07, 2005 at 10:14:46AM -0800, Paul Leach wrote:
> > We are talking about this because I can not see what value 
> there is to 
> > having the option for it to be critical or non-critical, whereas it 
> > adds complexity.
> 
> It adds a boolean configuration knob.  It adds to interop 
> testing complexity when we want to go to Standard, but since 
> most users will set this knob the same way it needn't add to 
> everyday testing complexity if you don't want it to.
> 
> > If someone could explain what security problem results if the KDC 
> > always sends it and always wraps it in AD-IF-RELEVANT, then 
> I would be 
> > satisfied. (Saying it is the same as the tranisited realm issue 
> > doesn't help me; I don't understand that one either.)
> 
> Application-specific transit policies allow for a relaxed 
> realm-wide transit policy and tighter transit policies for 
> specific applications.
> 
> In most intranets this is a feature noone needs.  But 
> Kerberos V is not designed only for use on intranets and we 
> may need this feature in the future (to say nothing of anyone 
> relying on it now, probably in the .edu world).
> 
> Kerberos V x-realm transit and PKI trust paths are similar 
> concepts, at least from the p.o.v. of applications that have 
> transit policies.
> 
> For the configuration-knob-averse a single KDC knob could be 
> used to control whether the KDC always sets the transited 
> policy checked flag and whether it wraps AD-INITIAL-VERIFIED- 
> CAS in AD-IF-RELEVANT.
> 
> Nico
> -- 
>

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 7 Feb 2005 17:17:06 -0600

> transit policy will be able to enforce one.

But then application then has no idea whether the KDC applied a policy
itself.

Wrapping in AD-IF-RELEVANT is akin to setting the TRANSITED-POLICY-
CHECKED flag.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 07 Feb 2005 18:51:17 -0500

>>>>> "Paul" == Paul Leach <[email-masked]> writes:

    Paul> This does not tell me why it needs to be critical. As far as
    Paul> I can see, as long as the KDC MUST put the info into the
    Paul> ticket under an AD-IF-RELEVANT, then any application that
    Paul> wants an application specific transit policy will be able to
    Paul> enforce one.

If a KDc has a very liberal policy or has not checked the material at
all, then it needs to be critical so application servers are required
to do additional checking.