Re: [kitten] Question about AES mode in Kerberos

[Nico Williams <[e-mail]>]

On Mon, Jan 09, 2023 at 05:55:24PM -0500, Greg Hudson wrote:
> On 1/9/23 15:25, Olga Kornievskaia wrote:
> > May I ask a stupid question? Is there something inherently different
> > about nonce handling/producing in Kerberos that's different from TLS?
> 
> The symmetric encryption facilities in TLS are in service only to the
> channel protocol.  TLS is regularly used to carry large amounts of data in a
> variety of application protocols.
> 
> The symmetric encryption facilities in Kerberos are in service primarily to
> the stateless authentication protocol, which uses long-term keys. Kerberos
> channel protocols exist (KRB-PRIV and GSS), using the same encryption
> facilities, but they are used less widely than the authentication protocol
> and much less widely than TLS.

That GSS is less widely used than TLS for bulk is not a reason not to
make GSS performant for bulk.

Unless we want to deprecate GSS-API.  Which we well could.  As the world
moves to JWT-like authentication systems (i.e., single-token, half round
trip systems with no key exchange) GSS becomes quainter and quainter as
anything other than an API for TLS in the same way that SSPI
-Microsoft's GSS equivalent- is an API for TLS in SChannel.

As far as _Internet_ protocols go, the only ones that use GSS for bulk
are FTP and NFS, with FTP being practically obsolete and NFS moving to
TLS.  But there are proprietary protocols that use GSS too.

Nico
--