Subject: [Ietf-krb-wg] Kerberos Anonymous names and AS PKINIT

From: Sam Hartman <[email-masked]>
Date: Sun, 27 Jul 2008 10:34:22 -0400

Jeff, Larry says that you were the one who requested the ability to
have anonymous authentication specific to a realm.  That is, you get
the anonymous principal, but a realm name rather than the anonymous
realm name.

That makes sense if you use the TGS option to request an anonymous ticket from an existing ticket.

However it seems that having this option available complicates the AS
case significantly.  It makes the model fail to work with GSS-API and
creates more testing and implementation complexity.

Also, the name is meaningless because the KDC has no reason to believe
that the client could successfully authenticate to its realm since it
did not sign its pkinit request.

I'd like to ask whether you see a use cases for anonymous realm names
in the AS case with anonymous pkinit or if we could require that
everyone use the anonymous realm name in that case.

Thanks,

--Sam

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg