Subject: RE: I-D ACTION:draft-ietf-krb-wg-kerberos-referrals-03.txt

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 17 Feb 2004 10:30:42 -0800

Nicolas Williams wrote:
> We're talking TGS-REQs here.
> Also, a single KDC can serve multiple realms.

It is the realm whose KDCs are going to process this request, not
necessarily the true realm of the service principal.

Larry

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Tuesday, February 17, 2004 9:42 AM
To: Liqiang(Larry) Zhu
Cc: [email-masked]
Subject: Re: I-D ACTION:draft-ietf-krb-wg-kerberos-referrals-03.txt

On Tue, Feb 17, 2004 at 09:09:03AM -0800, Liqiang(Larry) Zhu wrote:
> Nicolas.Williams wrote:
> > I'm also right about that field not being optional, so presumably
> you're
> > saying is that what should be sent is an empty string?
> 
> In our current implementation, this realm name is the realm of the KDC
> this AS_REQ is sent to, not the "true" realm of the client.  

We're talking TGS-REQs here.

Also, a single KDC can serve multiple realms.

> 
> > It's not about keying -- it's about having both, the sname/realm
> > requested by the client and the referred-to sname/realm be protected
> in
> > the reply.  The use of PA for this is a fine hack though.
> 
> The sname and realm in the request are protected by the authenticator
> checksum in PA_TGS_AP_REQ, and the referred names in the reply are
> protected by this subkey, which prevents the PA data from being
stripped
> out by disturbing the key derivation. Is the protection here adequate?

I'll think about this a little more -- somethin makes me uncomfortable.

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 19 Feb 2004 17:24:18 -0800

The following message was sent to chair off-list.

===================
None of us is going to make it. JK ended up with conflicts and could not
make it either.

can we talk about it in next meeting and have the chairs update the
status.
 
This version does solve the GNU FTP project we discussed at Minneapolis,
and we need the proposed subkey to secure the referral information.

Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Jeffrey
Hutzelman
Sent: Thursday, February 19, 2004 4:38 PM
To: [email-masked]
Subject: Re: I-D ACTION:draft-ietf-krb-wg-kerberos-referrals-03.txt

On Monday, February 16, 2004 15:39:29 -0500 [email-masked]
wrote:

> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This draft is a work item of the Kerberos WG Working
Group
> of the IETF.
>
> 	Title		: Generating KDC Referrals to locate Kerberos
realms
> 	Author(s)	: M. Swift, J. Brezak, J. Trostle
> 	Filename	: draft-ietf-krb-wg-kerberos-referrals-03.txt
> 	Pages		: 11
> 	Date		: 2004-2-16

Larry, will someone from Microsoft be able to talk about the status of
this 
draft at the WG meeting?

-- Jeff