Subject: [Ietf-krb-wg] anonmity ID comments II

From: Larry Zhu <[email-masked]>
Date: Thu, 14 Aug 2008 12:17:16 -0700

* A020 Apr 04 Sam Hartman <hartmans-ietf at mit.edu>
  > In the anonymous AS request, ...  which KDC do you contact for the
  > anonymous ticket?

Please review the proposed text:

   In order to request an anonymous ticket, the client sets the
   anonymous KDC option in an Authentication Service exchange (AS) or
   Ticket Granting Service (TGS) exchange.  If the server's KDC supports
   anonymous PKINIT as defined in Section 4.1, the client can contact
   the server's KDC.  If the client does not know the server's realm,
   the client can contact the client's KDC and then relies on the KDC to
   find the server's realm.  If anonymous PKINIT is not supported by
   either the client or the target KDC, the client can authenticate with
   the client's KDC using the client's long term keys in order to get an
   anonymous ticket.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Wed, 20 Aug 2008 11:30:14 -0400

I'm a bit concerned about this text because I don't think client's KDC
is well defined.  Do you mean KDC to which the client user would
authenticate if they were not anonymous?  Do you mean KDC which the
local machine has a key registered with?  (I'm guessing for Windows
you mean the second)

However I think that if you solve the authentication path issue you
can leave it unspecified which KDC you go to.  So, my personal opinion
is that if you close out the auth path issue the way you are planning
to do, you can close out this issue as implementation defined.

---

From: Larry Zhu <[email-masked]>
Date: Wed, 20 Aug 2008 10:30:18 -0700

I am fine if we just leave this out.