Subject: [Ietf-krb-wg] Possible mistake in draft-ietf-krb-wg-anon-12

From: Alejandro Perez Mendez <[email-masked]>
Date: Wed, 20 Oct 2010 15:47:34 +0200

Hello,

I think I found a mistake in draft-ietf-krb-wg-anon-12. Specifically the
following paragraph is confusing and does not make much sense:

According to [RFC4120 <http://tools.ietf.org/html/rfc4120>] the
   client name and the client realm in the EncTicketPart of the reply
   MUST match with the corresponding client name and the client realm of
   the anonymous ticket in the reply;

As EncTicketPart is part of the ticket, the text wouldn't make sense
since it will always be true.

    cname in EncTicketPart in Ticket == cname in Ticket

Additionally, I couldn't find such a statement in RFC4120.

What IMO it  seems to mean, is that the cname in the encrypted part of
the ticket must match the cname in the unencrypted part of the KDC
reply, but if so, it would break with RFC 4120 as explained below.

draft-ietf-krb-wg-anon-12 says that a client may use its real identity
(e.g. [email-masked]) in the request, and obtain an anonymous ticket as
response. If the client name in the unencrypted part of the reply must
match with the one in the encrypted part of the ticket, then that
identity be ANONYMOUS (as the one in the ticket). However, in such a
case the unencrypted cname in the response wouldn't match with the one
in the request performed by the user, as mandated in RFC 4120, section
3.1.5 (Receipt of KRB_AS_REP Message).

    If the reply message type is KRB_AS_REP, then the client verifies
       that the cname and crealm fields in the cleartext portion of the
       reply match what it requested.

Hence, in order to do not break with RFC 4120, different cname in
encrypted and unencrypted part of a KDC reply must be allowed.

Could anyone clarify this point?

Best regards,
Alejandro
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Fri, 22 Oct 2010 08:46:47 -0400

>>>>> "Alejandro" == Alejandro Perez Mendez <[email-masked]> writes:

    Alejandro> Hello, I think I found a mistake in
    Alejandro> draft-ietf-krb-wg-anon-12. Specifically the following
    Alejandro> paragraph is confusing and does not make much sense:

I agree.

    Alejandro> According to [RFC4120] the client name and the client
    Alejandro> realm in the EncTicketPart of the reply MUST match with
    Alejandro> the corresponding client name and the client realm of the
    Alejandro> anonymous ticket in the reply;

    Alejandro> As EncTicketPart is part of the ticket, the text wouldn't
    Alejandro> make sense since it will always be true.

    Alejandro>     cname in EncTicketPart in Ticket == cname in Ticket

    Alejandro> Additionally, I couldn?t find such a statement in
    Alejandro> RFC4120.

    Alejandro> What IMO it seems to mean, is that the cname in the
    Alejandro> encrypted part of the ticket must match the cname in the
    Alejandro> unencrypted part of the KDC reply, but if so, it would

I agree that is what it does mean and I agree that's a change from RFC
4120.  That's OK though: this draft updates RFC 4120. Also, the behavior
change only applies when the anonymous option is in use so it's
consistent with Kerberos extensibility rules.

Jeff, for your rfc-editor note:

old:
   client realm is the realm of the AS.  According to [RFC4120] the
   client name and the client realm in the EncTicketPart of the reply
   MUST match with the corresponding client name and the client realm of
   the anonymous ticket in the reply; the client MUST use the client

new:
   client realm is the realm of the AS.  According to [RFC4120] the
   client name and the client realm in the EncTicketPart of the reply
   MUST match with the corresponding client name and the client realm of
   the KDC reply; the client MUST use the client
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 22 Oct 2010 09:54:39 -0400

>   the KDC reply; the client MUST use the client

Sounds good.  I can incorporate this and your previous change into the RFC-Editor note, or you can submit a new version with all of the updates.  Your choice.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg