Subject: Kerberos Anonymity Support: unknown authorization data in AD-IF-RELEVANT

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 10 Jul 2006 13:45:18 -0700

This issue was raised during the face-to-face meeting, is it safe to
remove unknown authorization data? Cliff suggested it might be ok given
there is no identity for the client, the restriction does not apply.

 Martex Rex suggested an anonymous identity may be identifiable within a
"group". Since Kerberos does not define the notation of groups in
RFC4120, such usage of anonymity support would likely be implemented
using authorization data. In light of that thought, please review the
updated text for the handling of authorization data in the anonymity
i-d.

220a215,219
>    o  It contains no information that can reveal the client's
identity.
>       However the ticket can contain the client realm and the realms
on
>       the authentication path, and the authorization data may provide
>       additional information of the client.  For example, an anonymous
>       identity may be un-identifiable within a particular group of
223c222,223
< Zhu, et al.             Expires December 5, 2006                [Page
4]
---
>
> Zhu, et al.             Expires December 3, 2006                [Page
4]
228,229c228
<    This transited encoding type indicates that there is no information
<    available about the authentication path.
---
>       users, and this can be implemented by using authorization data.
231,233c230

243,246c253,258
<    When policy allows, the KDC issues an anonymous ticket.  The KDC
that
<    implements this specification MUST NOT carry information that can
<    reveal the client's identity, from the TGS request into the
returned
<    anonymous ticket.
---
>    When policy allows, the KDC issues an anonymous ticket.  Care MUST
be
>    taken by the TGS to ensure the client's identity is not revealed
>    unintentionally: TGS MUST process all authorization elements
>    including elements in the AD-IF-RELEVANT container [RFC4120].  The
>    TGS MUST remove all unknown authorization data in the
AD-IF-RELEVANT
>    container that may reveal the client's identity unexpectedly.

The full text is attached in the hope it is useful to people who are not
familiar with diff outputs.