Subject: [Ietf-krb-wg] anonmity comments III

From: Larry Zhu <[email-masked]>
Date: Thu, 14 Aug 2008 12:20:28 -0700

* A021 Apr 04 Sam Hartman <hartmans-ietf at mit.edu>
  > you need to keep track somewhere in your credential cache what KDC
  > you talked to so you can select the right ticket.  [This] issue
  > should be mentioned in the draft but we probably don't want to give
  > requirements for solutions;

This should not be applicable with the latest proposal where anonymous PKINIT is the only way to get a ticket with the anonymous realm and anonymous PKINT always results in a ticket with the anonymous realm.

Please comment on this if you disagree.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Thu, 14 Aug 2008 15:23:35 -0400

>>>>> "Larry" == Larry Zhu <[email-masked]> writes:

    Larry> * A021 Apr 04 Sam Hartman <hartmans-ietf at mit.edu>
    >> you need to keep track somewhere in your credential cache what
    >> KDC you talked to so you can select the right ticket.  [This]
    >> issue should be mentioned in the draft but we probably don't
    >> want to give requirements for solutions;

    Larry> This should not be applicable with the latest proposal
    Larry> where anonymous PKINIT is the only way to get a ticket with
    Larry> the anonymous realm and anonymous PKINT always results in a
    Larry> ticket with the anonymous realm.

    Larry> Please comment on this if you disagree.

I completely disagree.  I have two anonymous tickets in my cache
issued by different KDCs.  Which one do I use them with?  I need to
store that.

---

From: Larry Zhu <[email-masked]>
Date: Thu, 14 Aug 2008 12:35:16 -0700

> issued by different KDCs.  Which one do I use them with?  I need to

With the proposed text below, can you run into situations you have two anonymous tickets for the same server/service?

   In order to request an anonymous ticket, the client sets the
   anonymous KDC option in an Authentication Service exchange (AS) or
   Ticket Granting Service (TGS) exchange.  If the server's KDC supports
   anonymous PKINIT as defined in Section 4.1, the client can contact
   the server's KDC.  If the client does not know the server's realm,
   the client can contact the client's KDC and then relies on the KDC to
   find the server's realm.  If anonymous PKINIT is not supported by
   either the client or the target KDC, the client can authenticate with
   the client's KDC using the client's long term keys in order to get an
   anonymous ticket.

If you do, can you elaborate and maybe also propose text?

Thanks,

--larry

---

From: Sam Hartman <[email-masked]>
Date: Thu, 14 Aug 2008 15:48:41 -0400

Ah.  I was confusing client and service realms.  This issue never
existed in the first place as far as I can tell.  Please close and
accept my apology.