Subject: Re: ["Frank O'Dwyer" <[email-masked]>: Re: Kerberos login sniffer and cracker for Windows 2000/XP]

From: Jeffrey Altman <[email-masked]>
Date: Sun, 1 Dec 2002 16:13:38 EST

> So, I thought we had something approaching rough consensus that we
> definitely wanted DCE style support for encrypting things in a key
> combined with the host key for keyed hosts.
> 
> We still had open discussions on unkeyed hosts, looking at a variety
> of proposals.  Anonymous DH has come up as a suggestion several times
> and no one has actually objected to it or claimed it was insufficient
> so far.  Can we agree on anonymous DH and get on with life?
> 

If we are going to allow DH, is there any reason to not use TLS?  That
way sites that want to deploy certs are not susceptible to MITM
attacks.  Also if multiple requests are sent via TLS we don't have to
perform key exchange each time.

 Jeffrey Altman * Volunteer Developer      Kermit 95 2.1 GUI available now!!!
 The Kermit Project @ Columbia University  SSH, Secure Telnet, Secure FTP, HTTP
 http://www.kermit-project.org/            Secured with MIT Kerberos, SRP, and 
 [email-masked]               OpenSSL.

---

From: Sam Hartman <[email-masked]>
Date: Sun, 01 Dec 2002 16:38:42 -0500

>>>>> "Jeffrey" == Jeffrey Altman <[email-masked]> writes:

    >> So, I thought we had something approaching rough consensus that
    >> we definitely wanted DCE style support for encrypting things in
    >> a key combined with the host key for keyed hosts.
    >> 
    >> We still had open discussions on unkeyed hosts, looking at a
    >> variety of proposals.  Anonymous DH has come up as a suggestion
    >> several times and no one has actually objected to it or claimed
    >> it was insufficient so far.  Can we agree on anonymous DH and
    >> get on with life?
    >> 

    Jeffrey> If we are going to allow DH, is there any reason to not
    Jeffrey> use TLS?  That way sites that want to deploy certs are
    Jeffrey> not susceptible to MITM attacks.  Also if multiple
    Jeffrey> requests are sent via TLS we don't have to perform key
    Jeffrey> exchange each time.

I don't want to require the complexity of TLS; Kerberos is complex
enough without it.  Also, as it currently stands, Kerberos provides
its own security infrastructure; I think this is an important property
of the base protocol.  In addition, using TLS would require TCP.  I
think being able to do a Kerberos AS exchange in two or fewer round trips  is
important.

Finally there is the practical matter that I don't believe there
currently exists a TLS implementation MIT could use from a licensing
standpoint; we have not formally answered this question internally,
but I believe I have enough information to predict the answer with
high probability.  I won't get into a discussion of the specific
issues on this list, but I believe we would not be able to implement a
TLS solution.  Given that another solution exists, I'm going to argue
very strongly for the solution that we could actually implement.

--Sam

---

From: Leif Johansson <[email-masked]>
Date: Sun, 01 Dec 2002 23:44:53 +0100

>>>>>>"Jeffrey" == Jeffrey Altman <[email-masked]> writes:

<snip>

> think being able to do a Kerberos AS exchange in two or fewer round trips  is

I agree. Also one would have to profile TLS for this use since
kerberos can be used as a crypto mech inside TLS ...

	leifj

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 2 Dec 2002 08:00:38 -0800

> think being able to do a Kerberos AS exchange in two or fewer round trips  is

I second this.

Nico
--