Re: [kitten] I-D Action: draft-ietf-kitten-iakerb-00.txt

[Benjamin Kaduk <[e-mail]>]

On Wed, 10 Apr 2013, [e-mail] wrote:

>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Common Authentication Technology Next Generation Working Group of the IETF.
>
> 	Title           : Initial and Pass Through Authentication Using Kerberos V5 and the GSS- API (IAKERB)
> 	Author(s)       : Jim Schaad
>                          Larry Zhu
>                          Jeffery Altman
> 	Filename        : draft-ietf-kitten-iakerb-00.txt
> 	Pages           : 9
> 	Date            : 2013-04-10
>
> Abstract:
>   This document defines extensions to the Kerberos protocol and the
>   GSS-API Kerberos mechanism that enable a GSS-API Kerberos client to
>   exchange messages with the KDC using the GSS-API acceptor as the

I think the last "the" on this line should be "a".

Likewise for where "the proxy" appears in the introduction's last 
paragraph.

>   proxy, by encapsulating the Kerberos messages inside GSS-API tokens.
>   With these extensions a client can obtain Kerberos tickets for
>   services where the KDC is not accessible to the client, but is
>   accessible to the application server.

Other comments:


Also in the introduction, no expansion or motivation for the name/term 
"IAKERB" is given when it is first introduced.  (None is given elsewhere 
in the document that I can see, either.)

The top of page 4 seems to have some editing errors, referring to a 
"GSS-API server" (not acceptor), and then in the following paragraph does 
not specify that the KRB_ERROR message should be used in the IAKERB_PROXY 
message in place of an actual KDC reply.

Hmm, "GSS-API server" appears in at least one other place as well.

In the security considerations, the sentence "To reduce attack surface, 
firewall filters can be applied to allow from which hosts the client 
requests can be proxied and the proxy can further restrict the set of 
realms to which the requests can be proxied." has an unusual, perhaps even 
incorrect, sentence structure (in particular "allow from which hosts").

I think it would be feasible to extract the necessary bits from PKU2U and 
include them in this document, but defer to tomorrow's discussion.

-Ben