Subject: [Ietf-krb-wg] draft-ietf-krb-wg-otp-preauth-04.txt: the use of initial ticket flag

From: Larry Zhu <[email-masked]>
Date: Fri, 11 Jul 2008 02:16:37 -0700

I would like to submit the following comments and proposed changes as an individual.

Section 2.3.

Issues: I do not think the usage of the INITIAL ticket flag in -04 is intended or appropriate. This is because 1) according to RFC4120, the INITIAL flag is set whenever
the ticket is obtained in an AS exchange (instead of a TGS exchange). If a ticket is marked as "initial" whenever the PIN needs to be changed as proposed in -04, I do not see any consistence out of there and I do not see why such a change to the semantics of an existing ticket flag is justified. 2) in RFC3244, the requirement of "INITIAL" is designed to mitigate the following attack: if the user leaves an unlocked workstation, anyone who walks up to the station may be able to change the user's password. By requiring the "initial" flag, hopefully the password change service can force the user to present the old password in order to change the password; this way one cannot change the password from an accidentally unlocked workstation.

Proposed changes:

replace OLD:

   If a user PIN change is required and such
   a service is used then the KDC MAY return a TGT in the AS-REP but it
   is RECOMMENDED that it return a ticket for the PIN change service
   with the "initial" flag set until the PIN has been changed.  It is
   also RECOMMENDED that any PIN change service requires service tickets
   with the "initial" flag set.

With NEW:

    If a user PIN for OTP is required to change and such
   a service is used then the KDC MUST NOT return a TGT when the user is authenticated using this PIN. The KDC
   SHOULD return a service ticket to the PIN change service when the existing PIN is required to change, in order for the client to compute
   an AP-REQ according to RFC3244.   In order to complicate stealing service tickets intended for the PIN change service(and the corresponding session keys), the life
   time of the PIN-change service tickets should be just long enough to complete the PIN change, regardless whether the exiting PIN needs to be changed or not. A 1-minute lifetime is RECOMMENED. This way the PIN change service can effectively force the user to present the existing PIN in order to change to use a new PIN.

Note that the proposed changes here provide clarifications for some aspects of RFC3244 that were unfortunately left unspecified.

--larry
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: [email-masked]
Date: Fri, 11 Jul 2008 05:34:54 -0400

Larry

Thanks for the suggested change, I have no objections and will incorporate into the document as soon as possible.

I am leaving for vacation and so the submission will be made by Magnus Nyström on my behalf.

--Gareth 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Larry Zhu
> Sent: 11 July 2008 10:17
> To: [email-masked]
> Subject: [Ietf-krb-wg] draft-ietf-krb-wg-otp-preauth-04.txt: 
> the use ofinitial ticket flag
> 
> Issues: I do not think the usage of the INITIAL ticket flag 
> in -04 is intended or appropriate. This is because 1) 
> according to RFC4120, the INITIAL flag is set whenever the 
> ticket is obtained in an AS exchange (instead of a TGS 
> exchange). If a ticket is marked as "initial" whenever the 
> PIN needs to be changed as proposed in -04, I do not see any 
> consistence out of there and I do not see why such a change 
> to the semantics of an existing ticket flag is justified. 2) 
> in RFC3244, the requirement of "INITIAL" is designed to 
> mitigate the following attack: if the user leaves an unlocked 
> workstation, anyone who walks up to the station may be able 
> to change the user's password. By requiring the "initial" 
> flag, hopefully the password change service can force the 
> user to present the old password in order to change the 
> password; this way one cannot change the password from an 
> accidentally unlocked workstation.
> 
> Proposed changes:
> 
> replace OLD:
> 
>    a service is used then the KDC MUST NOT return a TGT when 
> the user is authenticated using this PIN. The KDC
>    SHOULD return a service ticket to the PIN change service 
> when the existing PIN is required to change, in order for the 
> client to compute
>    an AP-REQ according to RFC3244.   In order to complicate 
> stealing service tickets intended for the PIN change 
> service(and the corresponding session keys), the life
>    time of the PIN-change service tickets should be just long 
> enough to complete the PIN change, regardless whether the 
> exiting PIN needs to be changed or not. A 1-minute lifetime 
> is RECOMMENED. This way the PIN change service can 
> effectively force the user to present the existing PIN in 
> order to change to use a new PIN.
> 
> Note that the proposed changes here provide clarifications 
> for some aspects of RFC3244 that were unfortunately left unspecified.
> 
> --larry

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 11 Jul 2008 11:18:11 -0400

--On Friday, July 11, 2008 05:34:54 AM -0400 [email-masked] wrote:

> Thanks for the suggested change, I have no objections and will
> incorporate into the document as soon as possible.
>

Note that the cutoff for getting updated I-D's published before the meeting 
is Monday, July 14.  If you can get the update in by then and think it's 
ready, we can start a WGLC as soon as the updated I-D is published.

-- Jeff