Subject: Re: [Ietf-krb-wg] Kerberos anonymity and GSS-API names

From: Sam Hartman <[email-masked]>
Date: Tue, 09 Sep 2008 08:39:09 -0400

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> --On Friday, August 22, 2008 01:47:32 PM -0700 Larry Zhu
    Jeffrey> <[email-masked]> wrote:

    >> Jeffrey Hutzelman wrote:
    >>> Your proposed changes appear to answer the question asked in
    >>> A022 related to whether an > anonymous@REALM ticket can be
    >>> treated as anonymous, but does not answer the question asked >
    >> in A023 regarding the behavior of GSS_display_name.
    >> 
    >> What is the display_name() returns is left to
    >> implementations. No further change is needed for this IMO.

    Jeffrey> Ken?  Sam?

Sorry, I thought I had said I agreed much earlier.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 17 Sep 2008 16:37:16 -0400

> Sorry, I thought I had said I agreed much earlier.

You did, and I've provisionally marked this resolved.
However, Martin expressed the opinion that this is supposed to be 
mechanism-specific but not implementation-specific, and that an 
implementation should specify the display format to be used.  Does anyone 
have a response to those comments?

-- Jeff

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 17 Sep 2008 17:59:59 -0400

--On Wednesday, September 17, 2008 01:42:23 PM -0700 Larry Zhu 
<[email-masked]> wrote:

> A lot of implementations today already have anonymity support in other
> mechanisms (other than Kerberos) and they do prefer to keep the display
> name mechanism independent from the underlying mechanism. Mandating a
> specific display name would slow down the adoption of this technology.
> Therefore I speak against any further specification.

Perhaps we're talking past each other, or perhaps not.
I think you're saying that an application which gets a name of type 
GSS_C_NT_ANONYMOUS wants to show the user something like "Anonymous", 
regardless of the underlying mechanism.  There's nothing wrong with that.

The point is that the output of gss_display_name must not be the string 
"Anonymous" from your implementation, and "Anonymous Coward" from MIT's, 
and "Unknown" from Heimdal, and "[email-masked]" from some 
other one.

-- Jeff

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 17 Sep 2008 22:48:35 -0500

> have a response to those comments?

IIRC the spec is pretty loose on this, but I'd rather that mechanism
specifications specify this in detail.

That said, for anonymous names the spec is even looser.

And that said, there's no reason not to say to that implementations MUST
use GSS_KRB5_NT_PRINCIPAL_NAME.  (Also, this doesn't impact Larry's
implementation anyways, IIUC.)

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Thu, 18 Sep 2008 10:58:03 -0400

I tend to agree with Martin that people will use display names in
manners where consistentcy between implementations of mechanisms is
desirable.

I'm not sure how this should interact with anonymous.

---

From: Martin Rex <[email-masked]>
Date: Thu, 18 Sep 2008 18:12:13 +0200 (MEST)

> have a response to those comments?

The GSS-API (spec) is a standard for the API-level behaviour.
A GSS-API mechanism (spec) is a standard for the on-the-wire behaviour
and the mapping to the API-level standard.

On a related issue:  Microsoft has implemented Kerberos user2user
authentication (aka double-TGT-authentication) in addition to what
the Kerberos gssapi mechanism defines (the traditional service-ticket
plus authenticator).  In Windows 2003 this seems to be actually the
preferred method of authentication (because it doesn't need a
replay cache and avoids the problem of replay attacks for
distributed services on Microsoft Windows).

How does "anonymous authentication" affect double-TGT-authentication.
AFAIK, in traditional Kerberos, double-TGT-authentication is
standardized, it was just never added to/ defined for the Kerberos 5 gssapi
mechanism.

For the Kerberos 5 protocol itself (the issue that is primarily
discussed in the krb-wg), there is IMHO the question whether and how
anonymity should be supported for the double-TGT-authentication.

Regards,
-Martin

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 18 Sep 2008 11:23:48 -0500

> How does "anonymous authentication" affect double-TGT-authentication.

I think it should just work.  And even better, allows for anon-to-anon
authentication!

The client's anonymity comes from the client's TGT or TGS request.

The server's anonymity comes from the server's TGT, if it has one with
anon cname/crealm.

Nico

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 18 Sep 2008 13:08:44 -0400

--On Wednesday, September 17, 2008 10:48:35 PM -0500 Nicolas Williams 
<[email-masked]> wrote:

>> implementation should specify the display format to be used.  Does
>> anyone  have a response to those comments?
>

You're answering the wrong question.  This isn't about partially-anonymous 
names; it's about fully-anonymous names.  It's clear that they should use 
GSS_C_NT_ANONYMOUS, but what's not clear is what the string should look 
like, or even whether it should be specified by us or left up to the 
implementation.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 18 Sep 2008 12:15:08 -0500

> like, or even whether it should be specified by us or left up to the 

If GSS_Display_anonymous() returns GSS_C_NT_ANONYMOUS as the name-type,
then:

a) the name had better really be anonymous (not partially
   anonymous),

and

b) the name display syntax is irrelevant (since apps should know that
   GSS_C_NT_ANONYMOUS is special) *and*, one might think, subject to
   localization.

Nico

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 18 Sep 2008 13:33:17 -0400

--On Thursday, September 18, 2008 12:15:08 PM -0500 Nicolas Williams 
<[email-masked]> wrote:

>> You're answering the wrong question.  This isn't about
>> partially-anonymous  names; it's about fully-anonymous names.  It's
>> clear that they should use  GSS_C_NT_ANONYMOUS, but what's not clear is
>> what the string should look  like, or even whether it should be
>> specified by us or left up to the  implementation.
>

Yes; we've already agreed on that point.

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 18 Sep 2008 12:46:50 -0500

> Yes; we've already agreed on that point.

And the second point is not relevant?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 18 Sep 2008 15:04:35 -0400

--On Thursday, September 18, 2008 12:46:50 PM -0500 Nicolas Williams 
<[email-masked]> wrote:

>> >> clear that they should use  GSS_C_NT_ANONYMOUS, but what's not clear
>> >> is what the string should look  like, or even whether it should be

Of course it's relevant; in fact, it's the main point of discussion.  Which 
is one reason why I'm not commenting on it.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg