Subject: Re: Section 1 Kerberos Revisions for comment

From: [email-masked]
Date: Thu, 3 Aug 2000 11:50:00 -0500

1. In the second paragraph of section "1. Introduction," I believe
you've skipped the initial TGT acquisition step and jumped right into
the request to the TGS (not the AS) for a service ticket.  This
paragraph should be expanded to diffentiate initial authentication
(TGT acquisiton) and service ticket acquisition.  I believe this is
especially important in light of the PKINIT work which uses PK
technology for TGT acquisition, but doesn't touch the subsequent
service ticket stuff.  BTW, I realize this the more detailed material
is down further in the section.  Perhaps it would be sufficient to add
an introductory clause; something like "After initial authentication
to the Authentication Server (AS), ..."  Alternatively, use the term
"KDC" in this introductory text since the KDC typically consists of
both the AS and TGS.  Then the details can be left where they are
later in this section.

2. I don't agree with Sam Hartman's comments on section 1.2.  That is,
I think the Kerberos server principal lookup is very specific to the
Kerberos application space, and most efficiently implemented within
the KDC.  While it's true that more generalized service
lookup/directory services could be used, I'm concerned with
opportunities for application programmers to make mistakes and for
worse performance.  I didn't intepret the text as implying or
recommending other uses as Sam's comments did.  What do others think?

Minor typographical changes:
- -----------------------------
1. In the first paragraph of section "1. Introduction," a right paren
')' needs to be inserted after footnote 2.
2. Section 1.2 needs to be encompassed with <H3> and <\H3> rather than
the <P> tag, and the words capitalized to be consistent with the rest
of the document.

---

From: Sam Hartman <[email-masked]>
Date: 05 Aug 2000 21:08:45 -0400

>>>>> "David" == David Hemsath <[email-masked]> writes:

    David> 2. I don't agree with Sam Hartman's comments on section
    David> 1.2.  That is, I think the Kerberos server principal lookup
    David> is very specific to the Kerberos application space, and
    David> most efficiently implemented within the KDC.  While it's
    David> true that more generalized service lookup/directory
    David> services could be used, I'm concerned with opportunities
    David> for application programmers to make mistakes and for worse
    David> performance.  I didn't intepret the text as implying or
    David> recommending other uses as Sam's comments did.  What do
    David> others think?

I agree that the WG has reached consensus that name cannonicalization
can be used to look up what principal corresponds to a particular
service on a particular host.  I read the text to say that in
addition, I could look up the name of a fileserver in the
ATHENA.MIT.EDU domain simply by asking the KDC to cannonicalize
[email-masked] and getting something back like
fileserver/[email-masked].  If you do not read the text as
allowing this, perhaps you could help me by showing what forbids this
style of lookup.

Thanks for the clarification,

--Sam