Subject: ID review: draft-ietf-krb-wg-anon

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 5 Jul 2006 02:06:56 -0700

1) Section 3, the transited field and anonymous path decription is
awkward and hard to read, I would suggest to replace it with the
following:

176,190c176,195
<    o  The transited field [RFC4120] can either contain the client's
<       authentication path or contain the anonymous authentication path
<       defined as follows: the tr-type field of the transited field is
<       NO-TRANSITED-INFO (as defined later in this section) and the
<       contents field is an empty OCTET STRING.  If a TGS request
<       contains an anonymous ticket with a "normal" authentication path
<       (i.e. the transited field does not contain the anonymous
<       authentication path as defined above), then the reply ticket, if
<       any, MUST NOT contain the anonymous authentication path.  For
<       application servers, no transited policy is defined for the
<       anonymous authentication path, but all of the transited checks
<       would still apply if an anonymous ticket contains a "normal"
<       authentication path.  Note that the "normal" authentication path
<       in an anonymous ticket can be a partial path, thus it may not be
<       sufficient to identify the originating client realm.
---
>    o  The transited field [RFC4120] can contain either the client's
>       "normal" authentication path according to Section 3.3.3.2 of
>       [RFC4120] or the anonymous authentication path.  The transited
>       field of a ticket is an anonymous authentication path if the tr-
>       type field of the TransitedEncoding type [RFC4120] is NO-
>       TRANSITED-INFO (0) and the contents field is an empty OCTET
>       STRING.  If the service ticket in a TGS request is an anonymous
>       ticket with a "normal" authentication path, then the
authentiation
>       path in the reply ticket MUST also contain a "normal"
>       authentiation path: the TGS MUST add the name of the previous
>       realm.  However, if the service ticket in a TGS request is an
>       anonymous ticket with an anonymous authentication path, then the
>       reply ticket can contain either an anonymous authentication path
>       or a "normal" authentication path.  Thus a "normal"
authentication
>       path in an anonymous ticket can be a partial path: it may not
>       include all the intermediate realms in the authentication path.
>       No transited policy checking is needed for the anonymous
>       authentiation path.  However, transited policy checks defined in
>       Section 2.7 of [RFC4120] would apply to an anonymous ticket that
>       contains a "normal" authentication path.

2) section 4, the empty realm name should be replaced with the anonymous
realm name.

252c258
<    anonymous client principal name and the empty realm name.  For
---
>    anonymous client principal name and the anonymous realm name.  For

3) section 4, paragraph 3 is too wordy, I think it can simply be
replaced with:

<    principal.  In other words, the client name and client realm in the
<    EncKDCRepPart does not match with that of the returned anonymous
<    ticket.
---
>    principal, not the anonymous ones.

4) section 4, paragraph 6, the empty realm should really be the
anonymous realm

272,275d275
<    described in [RFC4120].  The client principal name in the
<    Authenticator of the KRB_AP_REQ MUST be the anonymous client
<    principal name and the client realm of the Authenticator MUST be an
<    empty KerberosString [RFC4120].
283a284,288
>    described in [RFC4120].  The client principal name in the
>    Authenticator of the KRB_AP_REQ MUST be the anonymous client
>    principal name and the client realm of the Authenticator MUST be
the
>    anonymous realm.

5) section 5, paragraph 5 should benefit with a refence to RFC2743.

329,331d332
<    Portable initiators are RECOMMENDED to use default credentials
<    whenever possible, and request anonymity only through the input
<    anon_req_flag to GSS_Init_Sec_Context().

339a340,346
>
>    Portable initiators are RECOMMENDED to use default credentials
>    whenever possible, and request anonymity only through the input
>    anon_req_flag [RFC2743] to GSS_Init_Sec_Context().