Re: [kitten] draft-ietf-kitten-cammac kdc-verifier omission

[Benjamin Kaduk <[e-mail]>]

On Wed, 18 Feb 2015, Simo Sorce wrote:

> On Wed, 2015-02-18 at 13:55 -0500, Benjamin Kaduk wrote:
> > On Thu, 12 Feb 2015, Tom Yu wrote:
> >
> > > Greg Hudson <[e-mail]> writes:
> > >
> > >
> > > I guess this is a roundabout way of suggesting text that includes:
> > >
> > >    The KDC SHOULD NOT make verbatim copies of CAMMAC contents into a new
> > >    CAMMAC when it cannot validate the original CAMMAC as authentically
> > >    originating from itself or another KDC in its local realm.  In such a
> >
> > The SHOULD NOT here makes me slightly uncomfortable.  (I understand Greg's
> > reasons for suggesting it, though.)  Can we say something about MUST NOT
> > ... as originating from itself or another KDC in its local realm or [some
> > other trusted KDC; wording TBD]?  This could potentially even include the
> > cross-realm case.
>
> Would it make more sense to say something like:
>
>         The KDC MUST NOT make verbatim copies of CAMMAC contents into a
>         new CAMMAC unless the original CAMMAC is authenticated by an
>         originator that is fully trusted by the KDC.
>         The KDC MAY choose to filter, transform, or propagate elements
>         from the original CAMMAC according to local policy.

It might.  Is this the first time we are using the word "trusted" in a
Kerberos RFC, though?  And being concrete does have something going for
it (we just have to get it right).

> This is less verbose and should be easier to read. It sill make clear
> (IMO) that CAMMAC can be trusted only if the KDC trusts fully one of the
> originators, which can be the local Realm's key or a Trusted Realm key,
> up to local policy.
>
> > >    situation, the KDC MAY choose to filter, transform, or propagate
> >
> > I think that what "such a situation" is potentially unclear and should be
> > specified more concretely.
>
> See my proposal above to make this part also less unclear. There is no
> need for "such situation", the KDC may *always* choose top do as it
> wishes with the CAMMAC.

And that is true; the KDC can always choose to do whatever it wants, in
some sense.

-Ben