Re: [kitten] I-D Action: draft-ietf-kitten-cammac-02.txt

[Greg Hudson <[e-mail]>]

On 03/09/2015 06:59 PM, [e-mail] wrote:
> A diff from the previous version is available at:
> http://www.ietf.org/rfcdiff?url2=draft-ietf-kitten-cammac-02

I'm not sure the new wording is quite right.  The new draft contains:

   A KDC SHOULD only make verbatim copies of CAMMAC contents to a new	
   CAMMAC when it has authenticated the CAMMAC as originating from a	
   local realm KDC [...]

   When a KDC makes verbatim copies of CAMMAC contents to a new CAMMAC	
   without having authenticated the first CAMMAC as originating from a	
   local realm KDC, it SHOULD NOT apply a kdc-verifier to the new	
   CAMMAC.

The first recommendation doesn't contain an exception for ticket
modification requests, where it is safe to copy a CAMMAC with only an
svc-verifier as long as the new CAMMAC also contains only an
svc-verifier.  The second recommendation is confusing because it seems
to apply only to a situation where the KDC is already violating the
first SHOULD.

   One possible exception is when a realm's policy allows a KDC	
   to make a verbatim copy of CAMMAC contents from a cross-realm TGT	
   from designated "fully-trusted" remote realms.  The local realm KDC	
   can safely apply a kdc-verifier to a new CAMMAC based on the cross-	
   realm TGT, because the client realm name in the resulting new ticket	
   will be that of the remote realm.  The presence of a remote client	
   realm name allows the local realm KDC to identify the originator of	
   the CAMMAC contents as being a remote realm.

I agree with the first sentence but not the other two.  I don't think
the client principal communicates the origin of all CAMMAC assertions.
For example, the authorization data in a CAMMAC might assert something
like "this client principal is a member of the wheel group," where the
client principal is in a foreign realm and "wheel" is in a group
namespace applying to the server realm.  Such an assertion should
hopefully come from, or be explicitly vetted by, the server realm's KDC,
not the foreign client realm.  The KDC might have a policy which says
that the foreign realm is higher-privilege and uses the same group
namespace, but that would be a deliberate decision to trust the foreign
realm, not a safe decision based on how the resulting CAMMAC will be
interpreted.

Also, a typo: "KDCM AY" should be "KDC MAY".