[Curdle] review of draft-ietf-curdle-gss-keyex-sha2-00

[Benjamin Kaduk <[e-mail]>]

Generally, this document is in good shape, and I think we should move
it forward.

My main comment/objection is that the security considerations should
note that the combination of GSS key exchange, GSS delegated
credentials, and use of insecure DNS to modify the requested server
principal name result in a situation where an attacker can easily
obtain a valid TGT+key for the client principal.  Obviously, RFCs
4462, 4120, etc. all implore us to not use insecure DNS in such a
fashion, but nonetheless major Kerberos libraries continue to do so.
At MIT we have disabled GSS key exchange for ssh because we default
to GSS credential delegation.

Some other nit-level comments:

On page 8, in step 5 of the procedure, do we want to give a
reference or two for the shared-secret computation above the
existing prose?  (Also, is the d_U and q_V terminology standard from
some related document?  I did not see them in RFC 4462.)

Also on page 8, step 6 could further clarify that this only occurs
when the server's final call to GSS_Accept_sec_context() returns
GSS_S_COMPLETE; anything else is an error condition.  Relatedly, the
way the GSS context negotiation loop's exit conditions are split
between step 6 and step 2 confused me a little on first read, but it
seems correct, and along with the RFC 7546 reference I think readers
will be okay.

On page 11, the description of the HASH input has a couple of
inconsistencies -- in RFC 4462, V_S is the server's "version"
string, though here we have it as the server's "identification"
string.  I don't think that's a problem per se, but wanted to note
it just in case.  Also, V_S excludes CR and LF, but V_C excludes CR
and NL; we should probably be consistent about NL vs. LF.

In sections 5.2.2 and later we continue to include refeferences for
MD5, DER, and Base64; RFC 4462 only included those references in the
first corresponding subsection.  At this point, it's probably not
worth making any changes, though.


And one editorial note:

On page 6, "non- zero" should not have a space.


-Ben