Re: [kitten] Fwd: New Version Notification for draft-vanrein-dnstxt-krb1-05.txt

[Rick van Rein <[e-mail]>]

Hi,
>> I'm very reluctant to agree to that, but I'd agree to saying that a TGS
>> client should first try the realm as it appears in the PTR RR and then
>> as up-cased if the first failed.
>
> What does it mean to "try the realm"?

In all but the local-realm case, the client may need its KDC to learn
about the proper case for the service's realm name.  But, as you've
shown, the KDC should now if the client doesn't.
> The only time that determining the canonical form of the remote
> realm becomes plausibly difficult, is when trust is constructed on
> the fly via public keys in DNSSEC.  When such a protocol is designed,
> the canonical realm suffix can be communicated as part of the
> authenticated cross-realm key exchange.

The ways for doing this that Nico and I are brooding on, are based on
PKINIT, and use certificates that hold the realm name in its proper
case.  DNSSEC/DANE in turn can validate those certificates.  So even in
that case the mapping to a known case is possible.

-Rick