IETF Logo Mail Archive

Re: [kitten] [EXTERNAL] Re: Windows Intent to revive and implement IAKerb draft-ietf-kitten-iakerb-03

Nico Williams <nico@cryptonector.com> Mon, 20 February 2023 03:29 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22FECC14CF1C for <kitten@ietfa.amsl.com>; Sun, 19 Feb 2023 19:29:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=cryptonector.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o1yca6ebOW4Q for <kitten@ietfa.amsl.com>; Sun, 19 Feb 2023 19:29:02 -0800 (PST)
Received: from cross.elm.relay.mailchannels.net (cross.elm.relay.mailchannels.net [23.83.212.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 134C8C14CEFF for <kitten@ietf.org>; Sun, 19 Feb 2023 19:29:01 -0800 (PST)
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 4CBF740CE1; Mon, 20 Feb 2023 03:29:01 +0000 (UTC)
Received: from pdx1-sub0-mail-a299.dreamhost.com (unknown [127.0.0.6]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id D54A440C23; Mon, 20 Feb 2023 03:29:00 +0000 (UTC)
ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1676863740; a=rsa-sha256; cv=none; b=kKGMR8ePyrQvP3SKa+o1C+NZC4TSA2vj5Fhl/CQcAT33FB0ztrUSoKIz0ilhQMH+7MCisS 0E7dqCZtGFTgABNovvPgvGm3gGTeCWzRfbuBjrchkWTya7UXQkFJjz/NlPbdrBJix/OeGL VYgW+aV5Nd0SktETjUpiQBRcfvvI8G2Q1HX0FC7mLzIx/fSJSkc/BU8s30c83H6c9ftoms l6b6mt4H0cScbqiTnvDatFdYx4HKy/D8QiDDlp/WdfXX/ukYX7Th9sHa+WpX0FfNJ/dD1v 1X2YHEKAS09CZtt6RI5QU0dWDZ2X9TWsNZ2NT1I8H96GVOF4xB1Bk9ElFa96WA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1676863740; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references:dkim-signature; bh=RGq9lsFM+BEo/LqJ9SbFvFPo/ab+qLZgcqWLfK401H4=; b=55YgwfbJIq2eqD22hQ7d71nh7DjpNFJX0bQH2M1JVs5HnDGIPvWVDs69NuNCZbFnsWAdVR IINS1WUQmGkmAx5ARCaYG83SyKXZoNIabO6F13G0reegOSDbWXifvaiFzOXDhDYLKNDgJo OF0Y9d9j+IkuP+GGv5GMgqsB2CLRzbeCur3RuyQr9sAMr9R3poL/4er1IDDlNpF99Dv/QY rq9cTifetVJ3X9SFh+wZLnHJIB4XvsNAeqEYljRrnMrqkfadmxk96ka6hMBOUcGTLAMUUy gukBz9vkVXFaXju0zlUdsodJaPvS1TMVjbl4vKExFR+Jn43LXtjVnT/aHzZ4xQ==
ARC-Authentication-Results: i=1; rspamd-9788b98bc-pt2br; auth=pass smtp.auth=dreamhost smtp.mailfrom=nico@cryptonector.com
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
X-MC-Relay: Neutral
X-MailChannels-SenderId: dreamhost|x-authsender|nico@cryptonector.com
X-MailChannels-Auth-Id: dreamhost
X-Towering-Left: 4d31ce462f4152aa_1676863741130_3954631991
X-MC-Loop-Signature: 1676863741130:518045738
X-MC-Ingress-Time: 1676863741130
Received: from pdx1-sub0-mail-a299.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.97.74.37 (trex/6.7.1); Mon, 20 Feb 2023 03:29:01 +0000
Received: from gmail.com (075-081-095-064.res.spectrum.com [75.81.95.64]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by pdx1-sub0-mail-a299.dreamhost.com (Postfix) with ESMTPSA id 4PKnvc10hQzHm; Sun, 19 Feb 2023 19:29:00 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cryptonector.com; s=dreamhost; t=1676863740; bh=RGq9lsFM+BEo/LqJ9SbFvFPo/ab+qLZgcqWLfK401H4=; h=Date:From:To:Cc:Subject:Content-Type; b=tDRNRHrcOUqfcGuzuCet1EA/3c9DEGkNmRvJAVkSHQaRKIXdXif2LyqYcMw/ZbmKr tftfGwQCwAfvGa926LQePOyAFIYrvPb35/fNoy6Fqan5S2Xq+OmVY1JPMfCSuUTLAO 5RdmEgiavx1PRUgEMBJzXlF+htHzAJDkIDnZL4wP4Juq1dT4gg/DUTxZIWvVdTKE2n 9GO0XHyBnPgtVizwjZa6wL3R0dB937pKH5xClHf3LmzNSpRaw9l9gpH5l93Xk2VbDd ZH1VA9nzr9iWSHOi+L2JniIORFiky+RqSz16LTgk9+2rQ8oYF5yyqyMO9BOiuNT71T 8iOPjai4ooXmg==
Date: Sun, 19 Feb 2023 21:28:57 -0600
From: Nico Williams <nico@cryptonector.com>
To: "Steve Syfuhs (AP)" <Steve.Syfuhs=40microsoft.com@dmarc.ietf.org>
Cc: Jeffrey Altman <jaltman@secure-endpoints.com>, "kitten@ietf.org" <kitten@ietf.org>
Message-ID: <Y/Lo+U/P9aerUgCW@gmail.com>
References: <MW4PR21MB1970A9D254B943A1763C55FF9CA09@MW4PR21MB1970.namprd21.prod.outlook.com> <de4cbe7b-85b5-7001-3a8c-74787990c6e0@secure-endpoints.com> <eb9fa7a4-a00d-f388-27aa-3624df8ce4f2@secure-endpoints.com> <MW4PR21MB197060FB388E7922FAADEB079CA19@MW4PR21MB1970.namprd21.prod.outlook.com> <Y/AYFbD6wCrszskG@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <Y/AYFbD6wCrszskG@gmail.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/kitten/SHJ1t-otyySRHrGeC_PtrQRKqWs>
Subject: Re: [kitten] [EXTERNAL] Re: Windows Intent to revive and implement IAKerb draft-ietf-kitten-iakerb-03
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/kitten/>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 20 Feb 2023 03:29:06 -0000

Another fix for MIT rt #8021 would be to have NACK entries in the cache
for service principal unknown.  Then GSS_Init_sec_context() for Kerberos
would fail and create the NACK entry, then it would fail immediately for
IAKERB so SPNEGO wouldn't try it.

Negative cache entries would be very nice to have, but they can also be
very expensive and bloaty if you're stuck with the venerable FILE cred
cache.

Nico
--

v2.23.0 | Report a Bug | By Email