Subject: RE: Comments on draft-ietf-krb-wg-naming-01.txt

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 2 Mar 2007 04:39:41 -0800

Jeffrey Hutzelman wrote:

> + Make it clear that all principal names involving a reserved realm
name
>  are reserved.

Done.

   Unless otherwise specified, all principal names involving a well-
   known realm name are reserved, and if a reserved principal name is
   used but not supported, authentication MUST fail with the code
   KRB_AP_ERR_RESERVED_PRINCIPAL_NAME_UNKNOWN.

            KRB_AP_ERR_RESERVED_PRINCIPAL_NAME_UNKNOWN          TBA
                 -- A reserved Kerberos principal name is used but not
                 -- supported.

   There is no accompanying error data defined in this document for this
   error.

>+ Clarify what it means for reserved names to be critical...
>  - Must the TGS reject requests where the client principal is
reserved?
>  - Must application servers reject AP-REQ's where the client principal
>    is reserved?
>  - What is the handling of reserved service principal names?

   The AS and the application server MUST reject the authentication
   attempt if a well-known realm name is used as the client realm or the
   server realm but not supported.  The TGS [RFC4120] MAY reject the
   authentication attempt if a well-known realm name is used as the
   client realm but not supported, and SHOULD reject the authentication
   attempt is a well-known realm name is used as the server realm but
   not supported.  Unless otherwise specified, if a well-known realm
   name is used but not supported in any other places of Kerberos
   messages, authentication MUST fail.  The error code is
   KRB_AP_ERR_WELLKNOWN_REALM_NAME_NOT_SUPPORTED, and there is no
   accompanying error data for this error.

            KRB_AP_ERR_WELLKNOWN_REALM_NAME_NOT_SUPPORTED       TBA
                 -- A well-known Kerberos realm name is used but not
                 -- supported.

> + The sentents "All reserved names... are critical..." does not belong
in
>  the abstract - it is not part of a condensed description of what the
>  document is about.

Removed

> [RFC2246] is not referenced at all

Removed

> + [ANON] is not used normatively.

Changed to be informative

>+ Name types and error codes to be assigned by Tom Yu

Just sent Tom a request for allocations.

>+ Spell checking!

Done

>+ The IANA considerations requires the creation of a new registry, but
>  does not fully describe what information the registry contains and
does
>  not set an assignment policy.  See RFC2434.

I added the following: the evaluation policy is "Specification
Required". Is this sufficient, do you have a good example? Thanks,

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Jeffrey
Hutzelman
Sent: Wednesday, February 28, 2007 9:30 AM
To: [email-masked]
Cc: Jeffrey Hutzelman
Subject: Comments on draft-ietf-krb-wg-naming-01.txt

+ Make it clear that all principal names involving a reserved realm name
  are reserved.

+ Clarify what it means for reserved names to be critical...
  - Must the TGS reject requests where the client principal is reserved?
  - Must application servers reject AP-REQ's where the client principal
    is reserved?
  - What is the handling of reserved service principal names?

+ The sentents "All reserved names... are critical..." does not belong
in
  the abstract - it is not part of a condensed description of what the
  document is about.

+ The IANA considerations requires the creation of a new registry, but
  does not fully describe what information the registry contains and
does
  not set an assignment policy.  See RFC2434.

+ [ANON] is not used normatively.

+ [RFC2246] is not referenced at all

+ Name types and error codes to be assigned by Tom Yu

+ Spell checking!

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 5 Mar 2007 16:57:12 -0800

The "reserved" name is now called "well-known" names, based on comments
from Jeff and Ken that the word reserved itself was reserved.

http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-naming-02.txt

Aaron D. Jaggard wrote:
> Also, in the security considerations, what about "Names MUST [or
> SHOULD] not be reused."  instead of "Care MUST be taken to avoid
> accidental reuse of names."

This is fine. Thanks,

--larry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Aaron D. Jaggard
Sent: Monday, March 05, 2007 8:04 AM
To: Liqiang(Larry) Zhu; [email-masked]
Cc: [email-masked]
Subject: Re: Comments on draft-ietf-krb-wg-naming-01.txt

I'm not able to find a definition in the document for "well-known
realm name"---it seems that if there are "MUST" requirements
conditioned on this term then it should have an unambiguous definition
(explicitly or by reference) in the document.

>    server realm but not supported.  The TGS [RFC4120] MAY reject the

Also, in the security considerations, what about "Names MUST [or
SHOULD] not be reused."  instead of "Care MUST be taken to avoid
accidental reuse of names."

Best regards,  Aaron