Subject: Re: [Ietf-krb-wg] Last call issues on anonymous

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 22 Aug 2008 16:55:10 -0400

--On Wednesday, July 30, 2008 03:22:02 PM +0200 Martin Rex 
<[email-masked]> wrote:

>  - Could there be or are there going to be any identifiers in the ticket
>    that will allow to "uncover" the principal who originally obtained
>    the ticket?
>
>  - Should anonymous-tickets be limited to single-use (i.e. not be cached),
>    so that independent sessions are not automatically correlated
>    by repeated use of a cached anonymous service ticket.

I've designated this A029.

I haven't seen any response or discussion to these points.

-- Jeff
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Larry Zhu <[email-masked]>
Date: Fri, 22 Aug 2008 14:02:06 -0700

>    that will allow to "uncover" the principal who originally obtained

The document provides prescriptive guidelines to TGS/AS that they MUST NOT include any identifier and the security considerations section has already beat this to death. I do not think anything further change is needed.

>    by repeated use of a cached anonymous service ticket.

This is discussed at the very end of section 4.

  A server accepting an anonymous service ticket may assume that
   subsequent requests using the same ticket originate from the same
   client.  Requests with different tickets are likely to originate from
   different clients.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jeffrey Hutzelman
Sent: Friday, August 22, 2008 1:55 PM
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: [Ietf-krb-wg] Last call issues on anonymous

-- Jeff