Re: [kitten] I-D Action: draft-ietf-kitten-pkinit-freshness-05.txt

[Greg Hudson <[e-mail]>]

On 03/22/2016 03:09 AM, Rick van Rein wrote:
>> It is the responsibility of the client not to retry indefinitely.
> 
> May I suggest that you state that in the text?  The current draft is a procedure, and could benefit from invariant statements to clarify the cases that fall outside of the intended procedure.

If I understand correctly, we are worried about an infinite loop of
AS-REQ -> KDC_ERR_PREAUTH_EXPIRED -> AS-REQ -> ... due to the section 2.5.

If we need to alter this text anyway, I don't like the requirement that
"If a client receives a KDC_ERR_PREAUTH_EXPIRED KRB_ERROR message that
includes a freshness token, it MUST retry using the new freshness
token."  MUSTs are to be used when behavior "is actually required for
interoperation or to limit behavior which has potential for causing
harm" (RFC 2119 section 6).  A client which implements RFC 6113 could
respond to KDC_ERR_PREAUTH_EXPIRED the same way it already does, by
retrying from the beginning, without affecting interoperability or
causing harm.

I suggest the following text:

  If a client receives a KDC_ERR_PREAUTH_EXPIRED KRB_ERROR message that
  includes a freshness token, it SHOULD retry the PKINIT-authenticated
  AS-REQ using the new freshness token.  The client MAY restart the
  conversation instead.  The client MUST limit the number of retries to
  avoid looping forever in case of a misbehaving KDC.