Subject: [Ietf-krb-wg] OTP Pre-auth Error Codes

From: <[email-masked]>
Date: Tue, 3 Mar 2009 06:23:24 -0500

Larry,

There is one remaining issue outstanding with the OTP pre-auth ID from
your review.
 
> j) section 3.4, should we indicate to the client the error conditions 
> so that the client can differentiate them?
> 

Would the following update overcome these concerns:
     
          The KDC generates the Client Key and Reply Key as described
          in <xref target="ReplyKeyGen"/> from the OTP value using the
          hash algorithm and iteration count if present in the
          PA-OTP-REQUEST.  The KDC MUST fail the request with
          KDC_ERR_INVALID_HASH_ALG if the KDC requires hashed OTP
          values and the hashAlg field was not present in the
          PA-OTP-REQUEST or if the value of this field does not
          conform to local KDC policy.  Similarly, the KDC MUST fail
          the request with KDC_ERR_INVALID_ITERATION_COUNT if the
          value of the iterationCount included in the PA-OTP-REQUEST
          does not conform to local KDC policy or is less than that
          specified in the PA-OTP-CHALLENGE.

          KDC_ERR_INVALID_HASH_ALG           TBA
          KDC_ERR_INVALID_ITERATION_COUNT    TBA

          The generated Client Key is then used to decrypt the encData
          from the PA-OTP-REQUEST.  If the client response was sent as
          a result of a PA-OTP-CHALLENGE then the decrypted data will
          be a PA-OTP-ENC-REQUEST and the client authentication MUST
          fail with KDC_ERR_PREAUTH_FAILED if the nonce value from the
PA-OTP-ENC-REQUEST is not
          the same as the nonce value sent in the PA-OTP-CHALLENGE.
          If the response was not sent as a result of a
          PA-OTP-CHALLENGE then the decrypted value will be a
          PA-ENC-TS-ENC and the authentication process will be the
          same as with standard encrypted timestamp pre-authentication
          <xref target="RFC4120" />
       
          The KDC MUST fail the request with KDC_ERR_ETYPE_NOSUPP if the
encryption type used by
          the client in the encData does not conform to KDC policy.
          Note that in two pass-mode, the PA-OTP-REQUEST will not be
          sent in response to a PA-OTP-CHALLENGE and so the client
          will not have selected an encryption type from that
          challenge.

--Gareth
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg