Re: [kitten] Kerberos Preauth Registration for OAuth2 device flow

[Luke Howard <[e-mail]>]

[resending from subscribed email, sorry Sam/Pavel]

Hi Sam,

> AS far as I can tell, the reply key is never used (it is replaced) so a
> long-term password is not needed.

Talking my own book here (although, I have no commercial interest) – would the vendor consider defining as a GSS-API mechanism that could be used with draft-perez-krb-wg-gss-preauth? (I suppose, if it needs to work with MIT as opposed to Heimdal, this may be a non-starter as the GSS pre-authentication implementation for MIT is experimental and only supports an earlier version of the draft.)

> 1) It appears to have the same   issues with anonymous pkinit that OTP
> has.
> You probably do not want to use this FAST factor with a armor ticket you
> got from anonymous pkinit.
> If you do, you need to verify the KDC's identity elsewhere.

Right, this is also something that came up with GSS pre-authentication. Of course, if FAST isn’t used then you also have the same problem.

Can they use TLS inside the PA exchange to authenticate the KDC?

Cheers,
Luke