Subject: AD-INITIAL-VERIFIED-CAS

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 07 Feb 2005 20:40:55 -0500

This is ticket #841.

OK, folks; here's the deal...

Back in Boulder, and subsequently on this mailing list, we reached a 
consensus on the criticality of AD-INITIAL-VERIFIED-CAS.  The agreed-on 
behaviour is described in pkinit-23.  In short, it says:

- The AS MUST provide AD-INITIAL-VERIFIED-CAS if PKINIT is used
- The AS wraps AD-INITIAL-VERIFIED-CAS in an AD-IF-RELEVANT wrapper
  if and only if it has checked local policy.  This is analogous to
  the user of the transited-checked flag, which indicates that the
  KDC has checked local policy with respect to cross-realm paths.
- The TGS MUST copy AD-INITIAL-VERIFIED-CAS as-is, including the
  wrapper if it is present.

The Kerberos specification REQUIRES that application servers check the list 
of transited realms against local policy for cross-realm paths if the 
transited-checked flag is not set.  This requirement insures that the 
policy is always checked by at least one of the KDC or the application 
server.  Without this requirement, cross-realm authenticationw would not be 
secure.

The reason for this complexity is that the design philosophy of Kerberos is 
that authorization checks are the responsibility of the application server, 
and that the KDC should not force the use of realm-wide policy which is 
more stringent that that desired by a particular application server.  A 
change in this philosophy is out of scope for PKINIT.

The purpose of the rules described for AD-INITIAL-VERIFIED-CAS is to 
provide similar protection for CA's used to authenticate a client for 
PKINIT -- that is, to ensure that the CA path is checked against local 
policy by at least one of the KDC or the application server EVEN IF THE 
APPLICATION SERVER DOES NOT KNOW ABOUT PKINIT.

As I said, these rules are the result of a working group consensus reached 
some time ago.  While it is possible to revisit that decision, the bar to 
doing so will be quite high.  Stated in other terms, changing the behaviour 
such that a KDC is permitted or required to use an AD-IF-RELEVANT wrapper 
even when it has not checked the CA path against local policy will require 
a strong working group consensus.

Now, Larry and Nico have come up with some text which proposes to allow the 
TGS to add or remove an AD-IF-RELEVANT wrapper, depending on whether it has 
checked the CA path against local policy.  To my mind, while this is a 
change in KDC behaviour, it is one designed to align the document with the 
intent of the previously-reached consensus.  As a result, the bar will be 
somewhat lower, but a working group consensus is still required, and Larry 
and Nico alone do not constitute a working group consensus.

I would like to see comments supporting or opposing Larry and Nico's 
proposed text.  I will post my own comments in a separate message.  Of 
course, discussion on the issue of revisiting the previous discussion is 
also welcome.

-- Jeff

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 07 Feb 2005 21:01:14 -0500

On Monday, February 07, 2005 08:40:55 PM -0500 Jeffrey Hutzelman 
<[email-masked]> wrote:

> Now, Larry and Nico have come up with some text which proposes to allow
> the TGS to add or remove an AD-IF-RELEVANT wrapper, depending on whether
> it has checked the CA path against local policy.  To my mind, while this
> is a change in KDC behaviour, it is one designed to align the document
> with the intent of the previously-reached consensus.  As a result, the
> bar will be somewhat lower, but a working group consensus is still
> required, and Larry and Nico alone do not constitute a working group
> consensus.
>

My own comments:

Overall, I think Larry and Nico's proposed change is good.  However, note 
that a TGS need not necessarily be PKINIT aware.  If it is not an 
AD-INIITAL-VERIFIED-CAS inside an AD-IF-RELEVANT wrapper will be copied 
unchanged into the issued ticket.  This is OK, because the AS has already 
verified the policy.

I would support the Larry/Nico text.
I think I would also support not making any change.

-- Jeff

---

From: Sam Hartman <[email-masked]>
Date: Mon, 07 Feb 2005 22:34:28 -0500

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> I would support the Larry/Nico text.  I think I would
    Jeffrey> also support not making any change.

Agreed; I prefer the Larry/Nico text but would be OK with no change.

--Sam