Subject: RE: FW: I-D ACTION:draft-zhu-kerb-anon-00.txt

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 21 Oct 2005 12:21:03 -0700

We have double insurance in this I-D; the Anonymous ticket flag is
reserved, right?

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Friday, October 21, 2005 12:13 PM
To: Liqiang(Larry) Zhu
Cc: Love H?rnquist ?strand; [email-masked]; [email-masked];
[email-masked]
Subject: Re: FW: I-D ACTION:draft-zhu-kerb-anon-00.txt

On Fri, Oct 21, 2005 at 12:04:50PM -0700, Liqiang(Larry) Zhu wrote:
> "empty SEQUENCE" is the only thing I believe we can count on that
> older implementations will always fail if they do not support
> anonymity as defined in this I-D.

Why not have an exceedingly-unlikely-to-have-been-used name?

I worry about security bugs in older implementations.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 21 Oct 2005 16:19:42 -0400

> We have double insurance in this I-D; the Anonymous ticket flag is

No, I don't think so..  You seem to want to insure that application servers 
which do not recognize anonymous tickets will always reject them. 
Unfortunately, I don't think either of the approaches you have suggested 
will accomplish that.

RFC4120 does not specify that the principal name consisting of zero 
components (an empty sequence) is invalid; therefore you cannot assume that 
implementations will not treat it as a valid principal name, possibly 
represented in string form as the empty string.

RFC4120 does not require that application servers reject tickets containing 
unknown ticket flags.  Unfortunately, it also fails to REQUIRE that they 
ignore them, though it does require that behavior of clients.

One thing you can do, I think, is expect implementations to reject tickets 
containing critical authorization data they don't understand...

-- Jeff