Re: [kitten] [nfsv4] rpcsec-gssv3 multi-principal authentication

[Nico Williams <[e-mail]>]

On Tue, Sep 02, 2014 at 01:13:06PM -0400, Benjamin Kaduk wrote:
> It would be nice if someone could confirm or contradict my conclusion that
> the triple of (opaque inner handle, nonce, mic) is a bearer token for
> performing multi-principal authentication.

Sorry, let's look at this:

 - As I had it the client sends an integrity-protected message that
   contains a MIC of a nonce.  The outer message is protected by a GSS
   security context authenticating the client host.  The inner MIC is
   made with the user's context.  Both contexts having the same
   acceptor.

 - The *new* RPCSEC_GSS security context uses the same GSS security
   context as the outer message in the establishment (see above) of this
   new context.

 - When the client sends an RPC on behalf of a user, then, it sends
   something like (simplifying):

    - RPC header:
       - program, procedure, XID
       - credential
          - *new* context ID
       - verifier
          - MIC taken over the header (minus verifier) with the old outer
            context
    - payload (possibly wrapped)

There's no bearer token here.  There's nothing in the credential or
verifier that a man in the wire can use to replay against the server and
get the same rights with a different payload (well, assuming we're
providing at least integrity protection to the payload).

The man in the wire would have to be able to manufacture a MIC and Wrap
tokens without having the related security context's session keys.

Could an attacker find a MIC made with a context authenticating the user
(to the same acceptor) of a payload that looks like a nonce?  Yes,
perhaps, but the client would have to pick that same nonce, so, not
really.

OK, now let's see if the same is true for the current draft.  [reads]

This section of the draft got rewritten, but my reading is that the gist
is the same.

Nico
--