Subject: Re: [Ietf-krb-wg] Kerberos Anonymous names and AS PKINIT

From: Jeffrey Altman <[email-masked]>
Date: Fri, 01 Aug 2008 12:49:54 -0400

I am not entirely sure I understand the question as described.

The use case that I had described years ago is a mirror of one
that is sometimes used with PKI. 

An organization establishes relationships with a number of providers
of Internet data sources access to which is permitted to all members
of the organization.  The organization does not wish any of the data
sources to know who within the organization is making a request to
access the data sources.  At the same time, the organization does not
want to have any record of which data sources were accessed by their
members.

The organization solves this problem using PKI by issuing short
lived X.509 certificates with completely random data for all subject
descriptors except perhaps organizational information which is a
copy of the issuer organizational information exposed by the CA. 
The data source permits access based solely upon the fact that the
X.509 client certificate was issued by an acceptable source.

If we require that all TGTs are issued with a real client principal
name and that only TGS issued tickets could be anonymous, then the
organization would have a record of which users are accessing which
data sources. 

What is required is an anonymous TGT that is trusted by the
realm that issued it such that anonymous TGT can be used to
anonymously authenticate to the TGS for the purpose of obtaining
realm specific service tickets or cross-realm TGTs.

I do not believe that the use case differs depending upon
whether PKINIT is used or not. 

However it is important to note that the inclusion of the
Kerberos realm name in the principal name implies that the
client is known to be a member of the realm that could in fact
be authenticated as a member of the community represented by the
realm.  Whether or not an anonymous-PKINIT authentication satisfies
this requirement for the realm might for example be dependent upon
external factors such as the request is being generated from a
machine which is known to belong to the realm.

Jeffrey Altman

Sam Hartman wrote:
>
> Jeff, Larry says that you were the one who requested the ability to
> have anonymous authentication specific to a realm.  That is, you get
> the anonymous principal, but a realm name rather than the anonymous
> realm name.
>
> That makes sense if you use the TGS option to request an anonymous ticket from an existing ticket.
>
> However it seems that having this option available complicates the AS
> case significantly.  It makes the model fail to work with GSS-API and
> creates more testing and implementation complexity.
>
> Also, the name is meaningless because the KDC has no reason to believe
> that the client could successfully authenticate to its realm since it
> did not sign its pkinit request.
>
> I'd like to ask whether you see a use cases for anonymous realm names
> in the AS case with anonymous pkinit or if we could require that
> everyone use the anonymous realm name in that case.
>
> Thanks,
>
> --Sam
>
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 1 Aug 2008 11:54:04 -0500

> whether PKINIT is used or not. 

+1

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 04 Aug 2008 16:55:43 -0400

> machine which is known to belong to the realm.

OK.  What I think I see you describing is a use case for a scenario in 
which a client authenticates to the AS as some real principal (whether 
using PKINIT or not), but is given back a semi-anonymous ticket (one with 
only a realm name). Is that correct?

I believe the scenario in which Sam and Larry propose to require the use of 
the fully anonymous principal is when _anonymous_ PKINIT is used; that is, 
when the client has not proven its identity to the AS.  Sam, is that 
correct?

If so, it seems that the proposal not only doesn't interfere with your use 
case, but in fact closes a potential hole, in that it prohibits the AS from 
issuing a ticket whose client principal name contains a realm in a scenario 
(anonymous PKINIT) in which the client is in fact not known to be a member 
of the community represented by that realm.

If all of this is the case, Jeff, do you have any objection to the proposed 
requirement?

As a side note...

The use case _I_ recall has this requirement:

> The organization does not wish any of the data
> access the data sources.

but not this one:

> At the same time, the organization does not

> organization would have a record of which users are accessing which

... but this is going to be true anyway, because an anonymous ticket is in 
fact not anonymous, and it is possible for the issuing entity to examine 
his records to find out to whom any given ticket was issued.

I am currently planning a set of changes to Heimdal which will give the KDC 
much more detailed logging, in part to allow us to track down usages of 
protocol versions and enctypes that we'd rather eliminate.  One of the 
pieces of information we're planning on recording is an identifier for each 
ticket issued, probably based on a hash of some set of ticket fields 
(possibly the entire ticket).  We also plan to compute the same hash on 
each ticket used in a TGS request.  Having this information will make 
discovering who used what service as simple as a join in an SQL query, 
whether or not anonymous tickets are used.

We have no particular intention of using this ability to intrude on users' 
privacy, but then we also don't promise our users that they can use our 
authentication service without us knowing who they are or what services 
they use.

-- Jeff

---

From: Sam Hartman <[email-masked]>
Date: Tue, 05 Aug 2008 09:22:56 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> On Fri, Aug 01, 2008 at 12:49:54PM -0400, Jeffrey Altman
    >> whether PKINIT is used or not.

    Nicolas> +1

I think the use case depends on whether the user ever authenticated to
the AS.
In the anonymous pkinit case that does not happen.

---

From: Jeffrey Altman <[email-masked]>
Date: Tue, 05 Aug 2008 09:32:02 -0400

> In the anonymous pkinit case that does not happen.
Sam:

Please read my e-mail again.  It states

"I do not believe that the use case differs depending upon
machine which is known to belong to the realm."

For an example, if the anonymous-PKINIT AS is tunneled
over a TLS session protected by a machine credential and
that machine credential is known to belong to the set of
machines that are within the realm.   That would satisfy the condition.

Think about a public library.  The requirement is that in order to
use the external database you must be using one of the library's
public terminals.

It might also satisfy the requirement if anonymous-PKINIT was
performed from the library's wifi network.  It depends on the
organization's policy.

Jeffrey Altman

---

From: Sam Hartman <[email-masked]>
Date: Tue, 05 Aug 2008 16:16:53 -0400

My personal opinion is that the advantages of requiring anonymous
pkinit give you the anonymous realm outweigh the cases you point out
where it would be desirable to include the realm.  As Larry and I
discussed on the list and in the meeting,there are significant
disadvantages to the complexity associated with multiple options in
this regard.

I do think that the base case of hiding information other than realm
name from third parties is valuable, and think that should be
supported in the TGS case.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 06 Aug 2008 10:19:53 -0400

> supported in the TGS case.

And also in the case of a non-anonymous AS request?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Wed, 06 Aug 2008 11:22:08 -0400

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> --On Tuesday, August 05, 2008 04:16:53 PM -0400 Sam
    Jeffrey> Hartman
    Jeffrey> <[email-masked]> wrote:

    >>  My personal opinion is that the advantages of requiring
    >> anonymous pkinit give you the anonymous realm outweigh the
    >> cases you point out where it would be desirable to include the
    >> realm.  As Larry and I discussed on the list and in the
    >> meeting,there are significant disadvantages to the complexity
    >> associated with multiple options in this regard.
    >> 
    >> I do think that the base case of hiding information other than
    >> realm name from third parties is valuable, and think that
    >> should be supported in the TGS case.

    Jeffrey> And also in the case of a non-anonymous AS request?

I didn't think the draft supported anonymous to the AS except via
anonymous PKINIT.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 06 Aug 2008 11:29:21 -0400

> I didn't think the draft supported anonymous to the AS except via

That's not what I asked.  The draft supports a non-anonymous AS request in 
which the AS is asked to issue an anonymous ticket; see the paragraph at 
the top of page 6 (in -07), "The client can use the client keys..."

In such a situation, the AS may issue a ticket with the anonymous client 
name and a non-anonymous realm.  In fact, arguably it is already required 
to do so; the first paragraph of section 4 states "Unless otherwise 
specified, the client can obtain an anonymous ticket with the anonymous 
realm name only by requesting an anonymous ticket in an AS exchange with 
the client realm set as anonymous in the request".  This suggests that 
anonymous PKINIT may be the _only_ way to obtain a fully-anonymous ticket.

-- Jeff

---

From: Sam Hartman <[email-masked]>
Date: Wed, 06 Aug 2008 12:36:33 -0400

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> --On Wednesday, August 06, 2008 11:22:08 AM -0400 Sam
    Jeffrey> Hartman

    Jeffrey> --On Tuesday, August 05, 2008 04:16:53 PM -0400 Sam
    Jeffrey> Hartman
    Jeffrey> <[email-masked]> wrote:
    >>  >> My personal opinion is that the advantages of requiring >>
    >> anonymous pkinit give you the anonymous realm outweigh the >>
    >> >> realm.  As Larry and I discussed on the list and in the >>
    >> >> I do think that the base case of hiding information other
    >> than >> realm name from third parties is valuable, and think
    >> that >> should be supported in the TGS case.
    >> 
    >>  I didn't think the draft supported anonymous to the AS except
    >> via anonymous PKINIT.

    Jeffrey> That's not what I asked.  The draft supports a
    Jeffrey> non-anonymous AS request in which the AS is asked to
    Jeffrey> issue an anonymous ticket; see the paragraph at the top
    Jeffrey> of page 6 (in -07), "The client can use the client
    Jeffrey> keys..."

    Jeffrey> In such a situation, the AS may issue a ticket with the
    Jeffrey> anonymous client name and a non-anonymous realm.  In
    Jeffrey> fact, arguably it is already required to do so; the first
    Jeffrey> paragraph of section 4 states "Unless otherwise
    Jeffrey> specified, the client can obtain an anonymous ticket with
    Jeffrey> the anonymous realm name only by requesting an anonymous
    Jeffrey> ticket in an AS exchange with the client realm set as
    Jeffrey> anonymous in the request".  This suggests that anonymous
    Jeffrey> PKINIT may be the _only_ way to obtain a fully-anonymous
    Jeffrey> ticket.

I certainly read the current draft to say that anonymous pkinit is the
only way to get a fully anonymous ticket.  I had missed the paragraph
at the top of page 6.

I do think in a situation where a client uses its long-term shared
secret to authenticate to the KDC and sets the anonymous option the
anonymous realm should not be used.

---

From: Larry Zhu <[email-masked]>
Date: Thu, 14 Aug 2008 01:50:28 -0700

Jeffrey Hutzelman wrote:
> when the client has not proven its identity to the AS.

+1. I do not think the proposal interferes with Jeff (Altman)'s use cases.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jeffrey Hutzelman
Sent: Monday, August 04, 2008 1:56 PM
To: [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: [Ietf-krb-wg] Kerberos Anonymous names and AS PKINIT

As a side note...

-- Jeff

---

From: Jeffrey Altman <[email-masked]>
Date: Thu, 14 Aug 2008 06:32:03 -0700

> +1. I do not think the proposal interferes with Jeff (Altman)'s use cases.
Your proposal is to make the use of the fully anonymous principal a MUST.

My use case requires that the fully anonymous principal be used whenever
the KDC cannot
authenticate the user AND does not have additional information that
describes the user as
a member of the local realm.    Cases where _anonymous_ PKINIT can be
used to obtain
an anonymous realm principal include authentication from machines that
are known to be
part of the local realm.  For example, computers in public libraries.