Subject: [Ietf-krb-wg] Use of Realm in OTP Hashes

From: <[email-masked]>
Date: Fri, 3 Sep 2010 08:58:11 -0400

Sam,

You raised a concern regarding the following text in section 3.6 of the
OTP pre-auth draft:

   o  An initial hash value, H, is generated:

             H = hash(realm|nonce|OTP)

      Where:
      *  "|" denotes concatenation
      *  hash is the hash algorithm selected by the client.
      *  sname is the UTF-8 encoding of the KDC's fully qualified domain
         name.  If the domain name is an Internationalized Domain Name
         then the value shall be the output of nameprep [RFC3491] as
         described in [RFC3490].
      *  nonce is the random nonce value generated by the client to be
         included in the PA-OTP-REQUEST.
      *  OTP is the OTP value.

>     >> Using the IDNA-2003 name of the KDC in the hash seems
particularly
>     >> problematic.  First, I'd recommend something based on the realm
rather
>     >> than a specific KDC.  Second, I think you can avoid 
>     >> introducing an IDNA
>     >> reference (and especially one to an obsolete IDNA).  I'd use 
>     >> the octets
>     >> of the realm string from the request itself.  You'll need to
decide
>     >> whether or not to include length and tag (probably not), but 
>     >> that ought
>     >> to allow you to side step I18N entirely.
>     >>
> 

The idea behind including sname in the hash is to allow an OTP server
that is generating the hashes to bind them to the relying party that is
requesting them.  It therefore needs something derived from the relying
party's identity and so if all KDCs serving a realm are considered
interchangable then I would think that the realm could be used instead
of an individual KDC's FQDN.

With this change, the text above could be re-worded as follows:

  o  An initial hash value, H, is generated:

             H = hash(realm|nonce|OTP)

      Where:
      *  "|" denotes concatenation
      *  hash is the hash algorithm selected by the client.
      *  realm is the name of the server's realm as carried in the realm
field of the AS-REQ. (Not including the tag and length from the DER
encoding.)
      *  nonce is the random nonce value generated by the client to be
         included in the PA-OTP-REQUEST.
      *  OTP is the OTP value.

Does this seem OK?

--Gareth
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Fri, 03 Sep 2010 09:44:07 -0400

I think that's OK.  I'd perfer to get an ACK from Tom or Jeff Hutzelman
or Nico, but I think that's fine.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 03 Sep 2010 14:01:46 -0400

> or Nico, but I think that's fine.

At first glance I was inclined to agree with your comment that the right 
identifier here is the name of the realm and not the name of an individual 
KDC.  The only reason I can think of not to do that is if for some reason 
we need the hash to be bound to a particular KDC.  But in fact, it is a 
design feature of Kerberos and of the preauth framework that the KDC does 
not retain state across a multi-step AS exchange, and so the client is not 
obligated to use the same KDC for every step.  Anything that binds a 
response to a particular KDC such that later requests must go to the same 
KDC breaks that.  So, I think I still agree that using the realm name is 
the right approach.

I certainly agree that if a realm name is used, it should be encoded as it 
would be for other uses in Kerberos and not in any other way.  I believe 
the current code does that.  I also agree that an IDNA-2003 reference at 
this time is problematic, and if we're going to use something that is a 
domain name, rather than a realm name, we need to do a bit better.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg