Subject: name-type significance for principal name equality

From: Simon Josefsson <[email-masked]>
Date: Thu, 05 Sep 2002 00:22:43 +0200

Quoting draft-ietf-krb-wg-kerberos-clarifications-00.txt:

,----
| 7.2. Principal Names
|
| As was the case for realm names, conventions are needed to ensure that all
| agree on what information is implied by a principal name. The name-type
| field that is part of the principal name indicates the kind of information
| implied by the name. The name-type should be treated only as a hint to
| interpreting the meaning of a name. It is not significant when checking for
| equivalence. Principal names that differ only in the name-type identify the
| same principal. The name type does not partition the name space. Ignoring
| the name type, no two names can be the same (i.e. at least one of the
| components, or the realm, must be different). The following name types are
| defined:
...
| A name type of UNKNOWN should be used when the form of the name is not
| known. When comparing names, a name of type UNKNOWN will match principals
| authenticated with names of any type. A principal authenticated with a name
| of type UNKNOWN, however, will only match other names of type UNKNOWN.
`----

Is the name-type significant when comparing principal names or not?

Has a text representation format for principal names been considered
for standardization?  E.g. a'la text representation of DNS domains;
concatenate all elements of the name and stick '.' between each pair,
and escape any existing '.' into '\.' and any existing '\' into '\\'.

Nits:

The reference to 8.2.3 in the last paragraph of 7.2 should be 8.2.4.

There are several "the the" editorial errors in the document.

---

From: Martin Rex <[email-masked]>
Date: Thu, 5 Sep 2002 22:50:31 +0200 (MET DST)

> and escape any existing '.' into '\.' and any existing '\' into '\\'.

Now I'm confused.

Kerberos has nametypes that are seperate from the actual principal name?

I got to know Kerberos as an implementation of a GSS-API mechanism
and I have never had any contact with anything besides the principal
name itselft.  Not when setting up my own MIT KDC for test purposes or
creating principals with kadmin.local.

GSS-API has its own notion of name-types, and all I see in rfc-1964
(the Kerberos 5 gssapi mechanism) refers to the GSS-API nametypes.

With rfc-1964 all Kerberos principal names can be transformed into a
"Kerberos principal name" representation with one single GSS-API-level
nametype GSS_KRB5_NT_PRINCIPAL_NAME.  Therefore GSS-API based apps
would not be able to distinguish two principal names if they had been
internally tagged with some extra level of Kerberos-nametype.

Are there really nametypes related to Kerberos principals that
do not get encoded into the "Kerberos principal name" format?

How is that distinction achieved?  Do they have seperate keys
or do they share a single key (longterm secret)?

Does anyone actually use that for any real purpose?

-Martin

---

From: Sam Hartman <[email-masked]>
Date: Fri, 06 Sep 2002 18:35:51 -0400

>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:

    Simon> Is the name-type significant when comparing principal names
    Simon> or not?

The two paragraphs you quoted are not inconsistent.  The name type is
significant when comparing principals, but it does not partition the
name space.

Think of it this way.  It is correct for an implementation to discard
the name type when storing principal names in its database, but if it
does store the name type then the implementation can fail to match the
name if the incoming name type is not either unknown or the same as
the one stored in the database.

AS a practical matter, name types are a good way to give your users a
loaded gun pointed at their feet or heads; they are confusing and
really not that useful.  It's probably best if implementations always
use an unknown name type.