Re: [kitten] Kerberos Service Discovery using DNS

[Greg Hudson <[e-mail]>]

On 03/05/2015 12:57 PM, Nathaniel McCallum wrote:
> http://datatracker.ietf.org/doc/draft-mccallum-kitten-krb-service-discovery/

I'm on board with this in general.  Some specific issues to be hashed out:

1. URL formats for basic RFC 4120 over UDP/TCP

The draft uses udp://hostname[:port] and tcp://hostname[:port] for
these.  The IANA registry notes some application-specific precedent for
the use of a "udp" scheme but there is no formal spec for it, and there
is no registration for "tcp" at all.  Obviously these URI schemes are
very context-dependent; a generic application such as a web browser
would have no idea what to do with a TCP or UDP URL.  On the other hand,
we are also proposing a very context-specific use of HTTP for MS-KKDCP,
and there is a ton of precedent for that (basically any kind of RPC over
HTTP).

2. UDP/TCP preference

Some implementation guidance may be necessary on this.  Implementations
are currently used to having their own preference of UDP versus TCP,
perhaps based on the packet size.

The current draft does allow the URI records to express no preference of
UDP versus TCP; one can simply give them the same priority and don't use
weights.  But if the URI records express a preference, should a client
always honor that preference, or can it ignore it--say, if the packet is
large?

3. Precedence of URI versus SRV

Discussion elsewhere suggested that the URI records, if present, should
have precedence over SRV records; if a client finds URI records, it
shouldn't do SRV lookups.  The draft should probably say that explicitly.

4. Security considerations

MS-KKDCP can offer security benefits for Kerberos traffic because it
uses TLS.  These added protections are mostly lost if unsecured URI
records are used to discover the proxy URL.  This is not a deal-breaker
as there are other reasons to use a proxy, but we should explicitly
state this in the security considerations.