Subject: Re: [Ietf-krb-wg] functional division of KDC model attributes

From: Leif Johansson <[email-masked]>
Date: Mon, 4 Aug 2008 14:35:10 +0200

On Thursday 31 July 2008 12:16:06 Tom Yu wrote:
> I believe existing KDC implementations use per-principal attributes
> for multiple purposes.  It would be useful to divide these by their
> function.
>

Here is a straw-man list of "tags" :

 - management
 - audit
 - policy

How does that line up with what you had in mind?

	Cheers Leif
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Leif Johansson <[email-masked]>
Date: Mon, 4 Aug 2008 14:35:10 +0200

- management
 - audit
 - policy

	Cheers Leif

---

From: Sam Hartman <[email-masked]>
Date: Fri, 08 Aug 2008 15:46:53 -0400

I don't understand the difference between these three tags.  If you
drop any one of them it is clear to me.

---

From: Sam Hartman <[email-masked]>
Date: Fri, 08 Aug 2008 15:46:53 -0400

---

From: "Henry B. Hotz" <[email-masked]>
Date: Fri, 8 Aug 2008 17:46:52 -0700

I think Tom Yu was proposing a 2-way split, which I would characterize  
as:

Operational (policy?)
Administrative (management?)

Functionally, tags in the former category would be enforced by the AS  
and TGS, while the latter would be enforced by the administrative  
processes, like password change and kadmind.

If I understand you correctly you're proposing a third for auditing.   
I presume that mainly means what information is logged, and perhaps  
how it's analyzed (audited) post-facto?  Could you elaborate?

---

From: Leif Johansson <[email-masked]>
Date: Mon, 11 Aug 2008 10:42:10 +0200

> > drop any one of them it is clear to me.

Yes that is what I meant to say.

	Cheers Leif

---

From: Martin Rex <[email-masked]>
Date: Fri, 22 Aug 2008 17:55:37 +0200 (MEST)

Personally, I don't like the concept of delegating (powerful) credentials
at all (it gives me the creeps), because it is always a significant
security problem to do so.

Knowing that it will the security problem is not going to be immediately
and massively exploited is not going to soothe my worries.

In theory, a carefully constrained delegation might improve the problem,
but the small improvement (the problem can NOT be cured!) is unlikely
to weigh in against the additional complexity in many, if not most
situations.

> how it's analyzed (audited) post-facto?  Could you elaborate?

I came to think of that when you mentioned auditing here.

IIRC correctly there were features added to the SESAME architecture
(something vaguely similar to DCE, based on Kerberos and developed
 in Europe ~1994-6) which added "audit" tags into kerberos tickets
so that auditing could differentiate if an authentication was
performed by the original principal, or by a different principal
who obtained the credentials through delegation.

AFAIK, the original Kerberos authentication did not have any
such provisions and probably still doesn't.

-Martin