Re: [kitten] Kerberos extra round trips I-D revised

[Greg Hudson <[e-mail]>]

On 11/11/2014 01:54 PM, Nico Williams wrote:
> I thought I ripped [service name redirection] out completely in the latest
> version.  Did I leave stray text about it?

My bad.  I started reviewing -01 by mistake, then attempted to update my
comments for -03, and missed that service name redirection was gone in -03.

>> * Does it make any sense to put a fast-reauth ticket in a KRB-ERROR2?
>> Wouldn't we want it in an AP-REP instead?  (That would render it out of
>> scope for this draft.)
> 
> Two reasons: a) the server might still want rcache avoidance, b) I
> wanted to avoid having to extend AP-REP (though I'd be happy to extend
> it anyways).  (b) is lame; (a) is not.

This brings up a larger point that I previously missed: in the rcache
avoidance flow with an odd number of tokens, there is no AP-REP token in
the exchange.

So, should rcache avoidance should use a modified KRB-ERROR or a
modified AP-REP?  I think using a modified AP-REP is more natural, but
it does mean adding a second new message type and adding the nonce to
both messages.

If we do use a modified KRB-ERROR in this flow, then we need to make
sure that we get all of the security properties we would get from the
AP-REP.  The AP-REP provides:

* Mutual authentication through use of the authenticator subkey (or
ticket session key if none was used).  An encrypted KRB-ERROR provides
this, but section 4 needs to say that an unencrypted KRB-ERROR with code
KDC_ERR_NONE MUST be treated as an error by the initiator.

* An acceptor subkey, which prevents whole-session replays even without
a replay cache (assuming the legitimate initiator uses it for all
important messages).  It might be okay to omit the acceptor subkey since
the nonce provides the same property, but we would definitely need some
rationale.

* A mirror of the authenticator timestamps, to prevent AP-REP replays.
This does not seem important if an authenticator subkey was used.  We
could require that the initiator use an authenticator subkey.

We also need to consider how this all interacts with
draft-vanrein-krb5-kdh.