Re: [kitten] GSS & krb5 mutual auth flags aren't -- they are about key confirmation

[Robbie Harwood <[e-mail]>]

Nico Williams <[e-mail]> writes:

> See subject.
>
> I assert that:
>
>  - GSS_C_MUTUAL_FLAG is badly misnamed
>
>  - GSS_C_MUTUAL_FLAGis not, never was, and never could have been about
>    mutual authentication in the sense of authenticating two peers to
>    each other,
>
>  - and GSS_C_MUTUAL_FLAGis, always was, and only could have been about
>    key confirmation.
>
> It is understandable that "mutual authentication" had a somewhat
> confusing definition back when RFCs 1508, 1509, and 1510 were written
> (huh, notice the sequential RFC numbers...).  But it's time to nail it
> down.
>
> First off, a high-level observation: GSS (and Kerberos) always deals
> in *two* principal names, so GSS and Kerberos are *always* about
> mutual authentication.
>
> The API by its very own nature implies mutual authentication even when
> one or the other (or both) name can be anonymous or pseudonymous.
>
> Second, we can look at all the mechanisms we know well enough, and all
> the mechanisms we can posit, and see that the above assertions hold:
>
>  - Mechanisms that can have just one, or just two context tokens:
>
>     - Kerberos
>
>       Mutual really only means key confirmation.
>
>       Mutual authentication is obtained naturally in that the acceptor
>       cannot GSS_Unwrap() (or GSS_VerifyMIC()) without having the
>       requested target acceptor's credentials.

This is true assuming it *does* call those functions.
Authentication-only use is not only possible but (unfortunately, in my
view) quite common: HTTP Negotiate, or GSSAPI auth in ssh, etc..  In
those cases, without mutual authentication, any authentication of (for
example) the HTTP server to the client must happen at another point
(from the TLS channel in HTTPS).

Of course, operating with mutual authentication along an untrusted
channel won't buy you much since it's not tamper-proof.  However, it
does help against passive observers when opportuniustic (untrusted)
encryption is used (as well as TOFU schemes).  I realize this is a bit
in the weeds and possibly not practically relevant, but this is a
conversation about definitions, so...

Thanks,
--Robbie