Received-SPF: pass (mail219-tx2: domain of fs.fed.us designates 199.135.140.16
 as permitted sender) client-ip=199.135.140.16;
 envelope-from=bnordgren@fs.fed.us; helo=mail.usda.gov ; ail.usda.gov ; 
From: "Nordgren, Bryce L -FS" <bnordgren@fs.fed.us>
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>, "kitten@ietf.org" <kitten@ietf.org>
Thread-Topic: [kitten] PKCROSS and philosophical tangents...
Thread-Index: Ac8dF9EVVIDV+Fq6S8CZNUDcti9KcAANe5wAAAZh4HAAUWokAAAA0odg
Date: Fri, 31 Jan 2014 19:05:56 +0000
Message-ID: <82E7C9A01FD0764CACDD35D10F5DFB6E684319@001FSN2MPN1-046.001f.mgd2.msft.net>
References: <82E7C9A01FD0764CACDD35D10F5DFB6E683D80@001FSN2MPN1-046.001f.mgd2.msft.net>
 <201401311750.s0VHoV9a010086@hedwig.cmf.nrl.navy.mil>
In-Reply-To: <201401311750.s0VHoV9a010086@hedwig.cmf.nrl.navy.mil>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [kitten] PKCROSS and philosophical tangents...
Precedence: list

Good to hear from someone who's done it. I haven't, so I mainly have questi=
ons instead of answers. Perhaps I should "briefback" my understanding of th=
e motivation of PKCROSS by rephrasing the intro section:

Axiom: Successful large-scale Kerberos deployments authorize users to maint=
ain their own authentication tokens. (e.g., I can change my own password)
Corollary: The lack of the ability for principals (KDC admins) to update th=
eir own tokens in a foreign KDC has inhibited the formation of Kerberos fed=
erations, and requires manual coordination between admins which is cumberso=
me and causes downtime.

In this light, I understand PKCROSS to be a means of automatically keying y=
our KDC's credentials in a foreign system. However, it is unclear to me how=
 these credentials get updated when they inevitably expire (or are stolen).=
 Is that section TBD or am I just dense? I took the draft to say that the i=
nitial certificate must stay the same forever or else risk being rejected a=
s a MITM attack. I'm willing to be persuaded, but I'm not quite seeing how =
the draft addresses the deficiencies it identifies.

PKCROSS to initially key your principal, plus a means to subsequently maint=
ain the authentication tokens for your principal? Well, that addresses the =
problem statement.

It's possible that account maintenance could be facilitated with a series o=
f recommendations and the corresponding security analyses. Expose your pass=
word-changing interface to the wide world and advertise which set of admin =
tools (MIT/heimdal/MS) are compatible? Stand up a web app which lets you lo=
g in and manage your credentials? Extend the base standard with a  "princip=
al management" message exchange? Dunno. It's probably important to specify =
that sites wishing to support federation SHOULD do certain things, one of w=
hich is to ensure that offsite (outside firewall), non-home-realm principal=
s have the means to manage their credentials.


> I looked at the papers you posted; they seem interesting, but if the goal=
 is to
> use one of those systems to get a Kerberos TGT ... well, I'd wonder what =
the
> advantage would be compared to one of the existing systems.

My purpose in bringing up those papers was not so much to propose a means o=
f getting a TGT as to ask about alternative means of trust evaluation for t=
he CA which signed the foreign KDCs certificate. Does the standard need to =
specify how trust is evaluated? Should it narrow the field to a handful of =
identifiable algorithms? Should it start simple but allow for growth?

Thanks for your time!
Bryce






This electronic message contains information generated by the USDA solely f=
or the intended recipients. Any unauthorized interception of this message o=
r the use or disclosure of the information it contains may violate the law =
and subject the violator to civil or criminal penalties. If you believe you=
 have received this message in error, please notify the sender and delete t=
he email immediately.