Subject: Re: [Ietf-krb-wg] COMMENT: <draft-ietf-krb-wg-anon-12.txt>

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 08 Oct 2010 11:54:25 -0400

--On Tuesday, October 05, 2010 12:54:33 PM -0700 Peter Saint-Andre 
<[email-masked]> wrote:

> Comment:
> The Security Considerations note that "Because there are plaintext parts
> of the tickets that are exposed on the wire, such matching by a third
> party observer is relatively straightforward." Presumably the use of
> transport layer security would minimize the attack surface here, so at
> least an informative reference to draft-josefsson-kerberos5-starttls
> might be appropriate.

I agree that a reference to some method for protecting against such 
observers would be appropriate.  However, that draft is not the only such 
method, so I think I want to bring this back to the working group to 
discuss.

-- Jeff
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Fri, 08 Oct 2010 21:53:53 -0400

How about something like
 
Two mechanisms: the FAST facility with the hide-client-names option in
[preauth] and the Kerberos5 starttls option [starttls] protect the
client identity so that an attacker would never be able to observe the
client identity sent to the KDC.
Transport or network layer security between the client and the server
will help prevent tracking of a particular ticket to link a ticket to a
user. In addition, clients can limit how often a ticket is re-used to
minimize ticket linking.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg