Subject: Re: FW: I-D ACTION:draft-zhu-kerb-anon-00.txt

From: "Aaron D. Jaggard" <[email-masked]>
Date: Mon, 7 Nov 2005 01:26:47 -0800

Dear all,

The anon-00 draft mentions that the client should ensure that a ticket
 is actually anonymous before using it for anonymous communication. 
This may be difficult if the ticket isn't strongly bound to the
encrypted part of the KDC's reply.

While we do not believe the inclusion of anonymous tickets prevents
basic authentication goals from being met, they may lead to curious
behavior.  In one example, sketched below, the client may incorrectly
believe that her name has not yet been revealed to the server (because
she incorrectly believes that the server has opened an anonymous
ticket and not a second, non-anonymous ticket), when in fact the
server has seen the client's name.

In particular (see Sec. 7.2 on p. 28 of
ftp://ftp.cis.upenn.edu/pub/papers/scedrov/ms-cis-04-04.pdf for more
details): a client could request two tickets from a TGS, one anonymous
and one regular.  An attacker interchanges these two tickets so that
the client is mistaken about which one is anonymous. The client then
sends two requests, one using each ticket, without requesting mutual
authentication from the server.  The attacker may replace the
authenticator that does not name the client with a copy of the
authenticator that does name the client.  As a result, the server will
be able to open both tickets but only one of the authenticators. The
server will then reply with an error message that does not name the
client, but which the attacker may modify so that it does name the
client.

As a result, the client would incorrectly believe that her name has
not yet been seen the server.  (Of course, this particular scenario
depends on the client wanting to interact with a server both
anonymously and non-anonymously.  However, it illustrates that curious
behavior is possible with respect to beliefs about anonymity.)

Best regards,

Fred Butler, Iliano Cervesato, Aaron Jaggard, and Andre Scedrov

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 7 Nov 2005 06:58:48 -0800

If the two tickets get swapped, it will be detected when AP_REQ is
verified when the ticket is used, but at that point, the client's
identity is revealed.

Hence at this point I believe this issue is specific to anonymity
support. 
-- Larry

-----Original Message-----
From: Aaron D. Jaggard [mailto:[email-masked]] 
Sent: Monday, November 07, 2005 1:27 AM
To: Jeffrey Hutzelman; Liqiang(Larry) Zhu; [email-masked]
Cc: [email-masked]; Iliano Cervesato; [email-masked];
Andre Scedrov
Subject: Re: FW: I-D ACTION:draft-zhu-kerb-anon-00.txt

 Dear all,

Best regards,