Re: [kitten] Comments on draft-ietf-krb-wg-camac-08

[Simo Sorce <[e-mail]>]

On Tue, 2014-07-29 at 21:50 -0400, Benjamin Kaduk wrote:
> On Tue, 29 Jul 2014, Greg Hudson wrote:
> 
> > On 07/28/2014 12:23 PM, Sam Hartman wrote:
> >> I expect advice on whether this should be contained in ad-if-relevant
> >> and on how an implementation that does understand this element should
> >> process contained elements that it does not understand.
> >
> > My preference is to:
> >
> > * Advise that CAMMACs be put inside AD-IF-RELEVANT.
> >
> > * Specify that authdata contained within a CAMMAC should be considered
> > non-critical.  (That is, you don't have to wrap everything inside a
> > CAMMAC in AD-IF-RELEVANT.)  RFC 4120 already does this for AD-KDC-ISSUED
> > (section 5.2.6.2, last paragraph), presumably under the assumption that
> > it is used for positive rather than negative authdata.
> 
> It looks like we discussed the AD-IF-RELEVANT situation back in November, 
> but the discussion fizzled out without reaching a real conclusion.
> Jeff's point in 
> http://www.ietf.org/mail-archive/web/kitten/current/msg04425.html that 
> we're designing a generic container because the previous generic container 
> wasn't good enough, so we should probably make sure this one is generic 
> enough seems pretty compelling on first re-read.  On the other hand, 
> Greg's reply to that message is also pretty compelling, namely, that de 
> facto we cannot create any critical authdata and expect them to be 
> actually treated as critical.  It would probably be good for people to 
> review that thread.

I thought we concluded that CAMMAC does not need to be wrapped in
AD-IF-RELEVANT because it has the same properties by definition and
therefore is always non critical as well, but I would not mind
specifying it has to be wrapped in AD-IF-RELEVANT for best
compatibility.

Perhaps I convinced myself we addressed the issue and then failed to
make it really explicit in the text, thanks Sam for being thorough, we
certainly need to add language similar to the AD-KDC-ISSUED text to make
it clear.

Also I do not think we need to create any specific registry with the
CAMMAC specification, the intention is that the CAMMAC can contain the
same AD data you would put in AD-IF-RELEVANT, just that the data is
"certified" by the KDC.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York