Re: [kitten] WGLC on draft-ietf-kitten-pkinit-freshness-01

[Michiko Short <[e-mail]>]

Greg, as always, thanks for the fast response.

In regards to the client request behavior, the bottom line is that I would prefer not to remove it from the RFC. We can make is optional, but it would need to be required to interoperate with some Microsoft Active Directory domains. We may be the only PKINIT implementation impacted. I don't know.


>>           3. In Windows Active Directory, accounts configured with AltSecID can receive a principal not found error and fail logon when the normal password AS ping is sent since the cname is not in the global catalog. By requesting the freshness token, the KDC can choose to return the preauth failure with the token when the account cannot be found.



> I don't understand this.  What is the message sequence?  Do you want to return a freshness token in a KDC_ERR_C_PRINCIPAL_UNKNOWN error?



No, the message sequence is that the client requests freshness, so the KDC can ignore the principal not found issue and return the freshness token with preauthn required. Then when they have preauth, the KDC can find the account and proceed as normal.





In regards to the error, I'll update the draft to use KDC_ERR_PREAUTH_EXPIRED and make FAST a normative reference. If anyone disagrees, then speak up.



>> 7.  Security Considerations



>> 2.  The KDC can determine authenticity and prevent tampering.



> Discussing FAST here seems confusing than helpful.  FAST protects against some kinds of tampering by a network attacker, but wouldn't even begin to protect against a rogue client tampering with the contents of the freshness token (e.g. changing a timestamp to make an old token look new).

I have removed the FAST statement and gotten bit of feedback on our side so I'll shoot another proposed draft later today.


Thanks,
Michiko Short
Program Manager | Authentication Protocols
Windows & Devices Group: OS Security