Re: [kitten] [nfsv4] draft-ietf-nfsv4-rpcsec-gssv3: request for review

[Nico Williams <[e-mail]>]

On Mon, Aug 04, 2014 at 01:22:22PM -0400, Benjamin Kaduk wrote:
> On Mon, 4 Aug 2014, Nico Williams wrote:
> >Then you're proposing that criticality be described for the other cases
> >where it's provided, correct?  I agree.
> 
> I think so?  I'm not sure I understand exactly what you're saying.
> The main thing I'm saying is that we define a critical bit for all
> types of rgss3_assertion, but do not specify what to set it to for
> one branch of the rgss3_assertion_u union.  That looks like what
> you're saying, too.

The critical bit is already factored out.  We should do the same for the
text.

> >>[...]
> >
> >I'm not sure that we can have a "host without credentials" any more
> >since anonymous PKINIT (and equivalents for other mechanisms[*])
> >suffices for the purpose of protecting the client from the user.
> 
> Many krb5 realms do not have PKINIT enabled on the KDC.

"Meh".  If they don't want PKINIT then they must key their clients.  If
they don't want to key their clients then they must enable anon PKINIT.

(Another possibility is to deploy a different mechanism for the
client<->server contexts.)

For single user systems where the user owns the system there is no need
for client credentials, and anyways, device enrolment can take care of
that.

The point is that clients can be expected to have credentials suitable
for this purpose.  I think this is quite clearly true.

Nico
--