Subject: Re: [Ietf-krb-wg] Last call issues on anonymous

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 17 Sep 2008 18:46:31 -0400

--On Friday, August 22, 2008 07:00:23 PM -0700 Larry Zhu 
<[email-masked]> wrote:

> Jeff wrote:
>>>  [[ -08
>  >> but unfortunately does not
>  >> [[ address the question of motivation
>
> Actually it made an attempt to provide the motivation in the paragraph
> quoted below.
>
>    <t>In this specification, the client realm in the anonymous ticket is
>    the anonymous realm name when anonymous PKINIT is used to obtain the
>    ticket.  The client realm is the client's real realm name if the
>    client is authenticated using the client's long term keys.  Note that
>    the membership of a realm can imply a member of the community
>    represented by the realm.  </t>
>
> I am trying to compile the above from Jeff (Altman)'s email and it ended
> up with just the one short sentence in the very end of the above
> paragraph.

Yeah, that doesn't really go a long way toward answering the question.

- Why would a client want a fully-anonymous service ticket?
- Why would it want a partially-anonymous service ticket?
- Why would it want anonymous PKINIT (an anonymous TGT)?

I guess if Paul is satisfied with the present text and there are no other 
comments, we can probably close this item.  Of course, I would like to hear 
from Paul directly on that...

>>> or of whether an implementation
>  >> [[ must support all possible modes to be compliant.
>
> Would it help to add the following as a new section:
>
> <section title="Interoperability Requirements">
>     <t>Conforming implementations MUST support the anonymous principal
> with a non-anonymous realm, and     they SHOULD support the anonymous
> principal with the anonymous realm using anonymous PKINIT.</t> </section>

I think I'd say that SHOULD support anonymous PKINIT if PKINIT is 
supported, but the current language is fine too.  I think this resolves 
this part of the issue.

> Note that -08 does update the abstract to indicates the different modes
> per the requests from the co-editor.

Not really.  You changed "without revealing the client's identity" to 
"without revealing the client's identity or the client's realm".  But the 
client's realm is part of its identity, so you haven't done anything but 
make the abstract more confusing.  I think I'd propose rewriting as follows:

   This document defines extensions to the Kerberos protocol to allow
   a Kerberos client to securely communicate with a Kerberos application
   service without revealing its identity, or without revealing more
   than its Kerberos realm.  It also defines extesions which allow a
   Kerberos client to obtain anonymous credentials without revealing
   its identity to the Kerberos Key Distribution Center (KDC).  This
   document updates RFC 4120, RFC 4121, and RFC 4556.

Note that I also note that we update RFC4121 (by defining how the GSS-API 
mechanism handles anonymous principals) and RFC4556 (by defining anonymous 
PKINIT and by adding the requirements described in section 7).

-- Jeff
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Larry Zhu <[email-masked]>
Date: Wed, 17 Sep 2008 16:13:03 -0700

Jeff wrote:

> I think I'd propose rewriting as follows:

>   document updates RFC 4120, RFC 4121, and RFC 4556.

Other than the obvious typo "extensions" vs "extesions", I am fine with the proposed text.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jeffrey Hutzelman
Sent: Wednesday, September 17, 2008 3:47 PM
To: Larry Zhu; [email-masked]
Cc: [email-masked]
Subject: Re: [Ietf-krb-wg] Last call issues on anonymous

-- Jeff