Subject: Re: [security-wg] Re: bridging of Kerberos realms

From: [email-masked], [email-masked]
Date: Tue, 01 Oct 2002 13:34:37 -0500

> As Derek pointed out, this then is a problem of determine the path to use
> between the three realms. U determines that to get to R, it needs to get a
> TGT from X for B, then gets a TGT from B to Y. 
> 
> All this code is in place, including the [capath] section. (That's
> Configurable Authentication path) which could define X->B->Y as the path.

Hm.  That could easily go into DNS.  At least, less easily than the
name of the host's realm and locations of the realm's KDCs.
Something like:

FOREIGN-REALM._kerberos.LOCAL-REALM. TXT "TRANSIT-REALM-1" "TRANSIT-REALM-2"
				     TXT "TRANSIT-REALM-1a" "TRANSIT-REALM-2b"

I've illustrated an uglier-than-normal case there the client has a
choice of going by either of two three-step paths.

---

From: "Douglas E. Engert" <[email-masked]>
Date: Tue, 01 Oct 2002 15:28:42 -0500

BUT Then you are trusting DNS to tell you what realms can be in the trust
path, and no way to verifiy that this is correct.     

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: "Douglas E. Engert" <[email-masked]>
Date: Tue, 01 Oct 2002 16:13:38 -0500

[email-masked], [email-masked] wrote:
> 
> I would never trust DNS that far!  I was just thinking of helping the
> client.  The service's realm's KDC and/or the service itself should
> still make whatever checks they deem necessary.

But you also don't want the client delegating to the wrong service. 
If the client can't trust the path, this can happen too.

> > > ...
> > > Hm.  That could easily go into DNS.  At least, no less easily than the

--

---

From: [email-masked], [email-masked]
Date: Tue, 01 Oct 2002 15:36:11 -0500

---

From: [email-masked], [email-masked]
Date: Tue, 01 Oct 2002 16:58:16 -0500

> If the client can't trust the path, this can happen too.

Ah, I see I still don't have the griddish "of course you always
delegate" mindset ... even though I usually do delegate.

OK, it can stay in [capaths], although shorter realm paths are of
course better.  (Ever try to convince yourself to trust a PGP key
five "handshakes" from your own?  Then you know the feeling.)