Subject: Re: Self-authenticating non-domain realms

From: Sam Hartman <[email-masked]>
Date: Fri, 01 Sep 2006 16:03:14 -0400

>>>>> "Saber" == Saber Zrelli <[email-masked]> writes:

    Saber> Hi,
    Saber> * On Wed, 16 Aug 06 at 16:49, Sam Hartman wrote:
    >> Hi.
    >> 
    >> So, we want to be able to have realms in cases where there is
    >> no DNS name to use and any DNS names will be unstable.  We want
    >> to be able to confirm that the realm name cannot be spoofed
    >> using some cryptographic technology.

    Saber> I dont see how the realm name can be spoofed.

    Saber> AFAIK, In the KDC reply, the EncKDCRepPart contanis the
    Saber> realm name as welll as a nonce that authenticates the

You are correct.  I was not able to come up with any attacks that
actually required a public key to defend against.  However I and
everyone I've talked to about this seems happier if public keys are
involved because they enable pkinit and various future work items like
TLS protection.

So, I'm proposing that it is desirable but not required.

---

From: Sam Hartman <[email-masked]>
Date: Fri, 01 Sep 2006 16:04:13 -0400

>>>>> "Douglas" == Douglas E Engert <[email-masked]> writes:

    Douglas> Are there any cross-realm issues that need to be
    Douglas> addressed, while using some non-hierarchal realm name?

You have the question of how to create cross-realm keys.  You have
questions about what if any hierarchical traversal you want to do.  (I
assume the answer is none)