Re: [kitten] Comments on draft-ietf-krb-wg-camac-08

[Jeffrey Hutzelman <[e-mail]>]

On Wed, 2014-07-30 at 11:02 -0400, Benjamin Kaduk wrote:
> On Wed, 30 Jul 2014, Simo Sorce wrote:
> 
> > I thought we concluded that CAMMAC does not need to be wrapped in
> > AD-IF-RELEVANT because it has the same properties by definition and
> > therefore is always non critical as well, but I would not mind
> > specifying it has to be wrapped in AD-IF-RELEVANT for best
> > compatibility.
> 
> I had some memories of coming to this conclusion as well, but don't see 
> anything in the list archive or meeting minutes.  Maybe it was from 
> discussion on one of the krb5 development conference calls.

Well, I'm glad my opinion today is more or less consistent with my
opinion of almost a year ago...

I think we only have two reasonable choices:

1) Accept that implementations don't treat unrecognized auth-data as
   critical and will never be fixed sufficiently well to be depended
upon,
   and give up on ever being able to have critical AD.

2) Attempt to build a protocol suite which, if implemented correctly,
allows
   a KDC or client to place critical constraints on the use of a ticket.

If we choose (1), then we should say so.  New containers such as
AD-CAMMAC should (always) be wrapped in AD-IF-RELEVANT, for
compatibility, and the data they wrap should be considered non-critical,
not as a result of the definition of the new container but because we've
given up on AD ever being critical.

If we choose (2), then being able to have authorization data which is
both critical and authenticated seems fairly important, and having
AD-CAMMAC imply non-criticality of the wrapped elements would prevent
that.  So, it shouldn't do that.  However, it seems reasonable for
AD-IF-RELEVANT(AD-CAMMAC(...)) to indicate that both the AD-CAMMAC and
everything it wraps are non-critical(*).

Regardless of which option we choose, the authorization data contained
within AD-IF-RELEVANT(AD-CAMMAC(...)) is non-critical.  In fact,
regardless of which option we choose, AD-CAMMAC does not affect the
criticality (or lack thereof) of the things it wraps.

So really, this just boils down to whether we are ready to make a
statement that Kerberos doesn't really have critical authorization data
after all.

-- Jeff


(*) Note that this is _not_ the same as AD-IF-RELEVANT implying
non-criticality for everything contained within it down to every depth.
In particular, it is possible to imagine a container which can safely
ignored in its entirety, but for which ignoring individual contained
elements produces the wrong effect.