Re: [kitten] Clarification on draft-williams-kitten-krb5-pkcross-02

[Nico Williams <[e-mail]>]

On Mon, Jun 9, 2014 at 10:41 PM, Greg Hudson <[e-mail]> wrote:
> On 06/09/2014 10:45 PM, Nico Williams wrote:
>> As I wrote the I-D you'd use an AS exchange, but I do believe a TGS
>> would be better, if only because it'd be weird to have an AS-REP issue
>> a non-INITIAL ticket or a ticket with non-empty transit path, or a
>> ticket for client and service principals with different realms.
>
> The TGS-REQ path is already too complicated.  The KDC already has to
> deal with at least five cases:
> ...
>
> Cases 4 and 5 aren't the IETF's doing, of course, but that doesn't mean
> we can reasonably avoid supporting them.  I'd probably rather add a
> third type of KDC request than add a sixth variant of TGS which uses the
> AS-REQ preauth machinery and doesn't use a header ticket.  (An AS-REQ
> variant might still be a reasonable option; I haven't reviewed the draft
> in enough detail to have a strong opinion about that.)

I find adding a new request type that will differ mostly only as to
the application tag and pre-auth choice a bit silly.  There's a cost
to it too: dissectors for things like Wireshark and Netmon won't know
about the new requests, even though the new request will be so like
the old.

The main reason to separate these at all is for separation of
services, which for Kerberos is really mostly about class of service /
load balancing -- give higher priority to TGS requests than to PKINIT.
TGS requests are usually fast: it's all symmetric key crypto, while
PKINIT AS requests are slower due to the PK crypto.

At a high-level we have:

 - has PA-TGS -> TGS
 - has x-realm PKINIT -> new thing
 - anything else -> AS

Separation of service should have been done by using [optionally]
different port numbers, not different tag numbers.

Thinking of it this way this, I'd rather use AS for this and not a new
request type, due a) to the fact that we already have slow AS
requests, but not slow TGS requests, b) AS req

Nico
--