Subject: Re: Some questions on the password cracking issue

From: Jeffrey Altman <[email-masked]>
Date: Mon, 2 Dec 2002 16:17:15 EST

These are of course my personal opinions.

> 1) Are the set of keyed machines important enough as Kerberos clients
>    that we should consider optimizing a solution for that case?

Yes.  Keyed machines make up the vast majority of Windows 2000/XP
machines that are part of Windows Domains.  These machines are likely
to be the target of the majority of the attacks.  These machines are
often Active Directory servers or Exchange servers which if
compromised would allow significant other damage to occur.  Optimizing
a solution for these systems would most likely ensure that Microsoft
implements it.

Of course, we have yet to hear from anyone from the Microsoft camp
yet.
 
> 2) If we do solve the keyed machine problem as a special case, should
>    we reduce the number of round trips by restricting our solution to
>    clients with host principals in the same realm as the AS request is
>    destined for?

No.
 
> 3) How much do we care about MITM attacks?  Is detection of these
>    attacks necessary?  Is it sufficient?

I am happy to promote a solution that can be implemented in the next
three months that does not addres MITM attacks provided that we
address the MITM attack case in the not so distant future.

 Jeffrey Altman * Volunteer Developer      Kermit 95 2.1 GUI available now!!!
 The Kermit Project @ Columbia University  SSH, Secure Telnet, Secure FTP, HTTP
 http://www.kermit-project.org/            Secured with MIT Kerberos, SRP, and 
 [email-masked]               OpenSSL.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 02 Dec 2002 16:20:18 -0500

>>>>> "Jeffrey" == Jeffrey Altman <[email-masked]> writes:

    Jeffrey> I am happy to promote a solution that can be implemented
    Jeffrey> in the next three months that does not addres MITM
    Jeffrey> attacks provided that we address the MITM attack case in
    Jeffrey> the not so distant future.

I don't think anyone besides Microsoft has a chance of implementing
any solution to this problem in the next three months and getting it
out.

I'll be somewhat surprised if they decide to do that.