Subject: [Ietf-krb-wg] Kerberos error code 82 conflict in draft-ietf-krb-wg-pkinit-alg-agility-06

From: Tom Yu <[email-masked]>
Date: Mon, 05 Nov 2012 19:37:30 -0500

For discussion tomorrow:

While I was going through my database of Kerberos number assignments
in preparation for handing off numbers to IANA, I found that there is
a conflict for error code 82.  draft-ietf-krb-wg-pkinit-alg-agility-06
has KDC_ERR_NO_ACCEPTABLE_KDF=82, while the published RFC 6111 has
KRB_AP_ERR_PRINCIPAL_UNKNOWN=82.

I'm not sure how this happened.  I tried to find e-mail relevant to
this assignment but could not.  (I haven't done a really extensive
search though.)  Unfortunately, I also see

error_code KRB5KDC_ERR_NO_ACCEPTABLE_KDF, "No acceptable KDF offered"

in the MIT krb5 code, which we seem to have some released code
referencing.  RFC 6111 seems to have priority, though:

2007-03-03 draft-ietf-krb-wg-naming-03
vs
2007-07-09 draft-ietf-krb-wg-pkinit-alg-agility-03

were the earliest versions of each that I could find.

What should we do about this?  Has anyone implemented anything that
uses KRB_AP_ERR_PRINCIPAL_UNKNOWN=82?

Sam has suggested that we overload the error code, because there
shouldn't be a situation where an unknown well-known principal name is
used in conjunction with PKINIT algorithm agility.  I think it's still
possible, but unlikely.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Greg Hudson <[email-masked]>
Date: Tue, 06 Nov 2012 01:04:19 -0500

> referencing.  RFC 6111 seems to have priority, though:

Personally, I don't think it would be a big deal to change this error
code despite the released code, since the error itself isn't likely to
appear in practice until people start disabling SHA-256.

I don't know that my opinion would gain consensus among MIT krb5
developers, but my individual preference would be to reassign the error
code in the alg-agility draft.

---

From: Simo Sorce <[email-masked]>
Date: Tue, 06 Nov 2012 08:43:21 -0500

> used in conjunction with PKINIT algorithm agility.  I think it's still

If it is the error I thin it is I think we use that error code in
FreeIPA to detect when some users need migration.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

---

From: Will Fiveash <[email-masked]>
Date: Tue, 6 Nov 2012 14:31:34 -0600

> uses KRB_AP_ERR_PRINCIPAL_UNKNOWN=82?

I do not find any reference to that symbol in current Solaris code.
-- 
Will Fiveash
Oracle Solaris Software Engineer
http://opensolaris.org/os/project/kerberos/
Sent using mutt, a sweet, text based e-mail app <http://www.mutt.org/>
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Will Fiveash <[email-masked]>
Date: Tue, 6 Nov 2012 14:31:34 -0600

---

From: Tom Yu <[email-masked]>
Date: Tue, 06 Nov 2012 17:49:12 -0500

> FreeIPA to detect when some users need migration.

Would you care to elaborate on how you use that error code to detect
when users need migration?  That is somewhat surprising.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Simo Sorce <[email-masked]>
Date: Tue, 06 Nov 2012 18:04:22 -0500

> when users need migration?  That is somewhat surprising.

I was mistaken, we do not rely on the error code luckily. (sorry had
time to check the code just now and I was misremembering it).

Simo.