Subject: [Ietf-krb-wg] OTP and anonymous pkinit

From: [email-masked]
Date: Wed, 17 Aug 2011 17:39:57 -0400 (EDT)

I was going to make a last call comment, but decided to ask here
first.  The security considerations section of the OTP draft says:

   As described in section 5.4 of [RFC6113], FAST can use an anonymous
   TGT obtained using anonymous PKINIT [RFC6112] [RFC4556] as the
   Armor Key. However, the current anonymous PKINIT proposal is open
   to man-in-the-middle attacks since the attacker can choose a
   session key such that the session key between the MITM and the real
   KDC is the same as the session key between the client and the MITM.

Is this actually still true?  And is "session key" the right term if
so?  Also, the discussion doesn't mention the possibility of the
client verifying the KDC's identity through a certificate, and just
makes a blanket recommendation against combining anonymous PKINIT and
OTP.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Wed, 17 Aug 2011 19:15:38 -0400

>>>>> "ghudson" == ghudson  <[email-masked]> writes:

    ghudson> I was going to make a last call comment, but decided to ask
    ghudson> here first.  The security considerations section of the OTP
    ghudson> draft says:

    ghudson>    As described in section 5.4 of [RFC6113], FAST can use
    ghudson> an anonymous TGT obtained using anonymous PKINIT [RFC6112]
    ghudson> [RFC4556] as the Armor Key. However, the current anonymous
    ghudson> PKINIT proposal is open to man-in-the-middle attacks since
    ghudson> the attacker can choose a session key such that the session
    ghudson> key between the MITM and the real KDC is the same as the
    ghudson> session key between the client and the MITM.

    ghudson> Is this actually still true?  And is "session key" the
    ghudson> right term if so?  

It is not.
However there ar attacks when  the KDC doesn't know the OTP value or
where the OTP value is too short and the KDC is not verified.

    ghudson> Also, the discussion doesn't mention the
    ghudson> possibility of the client verifying the KDC's identity
    ghudson> through a certificate, and just makes a blanket
    ghudson> recommendation against combining anonymous PKINIT and OTP.

*sigh*
I thought we fixed this text already.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: <[email-masked]>
Date: Thu, 18 Aug 2011 05:01:11 -0400

> I thought we fixed this text already.

This text was reviewed and updated during the reviews of versions 12 and 13 where it was felt that the original issue was resolved in anonymity-12 but there were still concerns

So do people believe that this issue no longer exists?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg