Re: [kitten] New draft submitted for "Authentication Indicator in Kerberos tickets"

[Benjamin Kaduk <[e-mail]>]

On Mon, 28 Oct 2013, Nathan Kinder wrote:

> Hi,
>
> I submitted a new draft to IETF last week that seems to fit into the charter 
> for this working group.  The draft is for adding an indicator of the 
> authentication used into Kerberos tickets.  The draft is available here:
>
> http://tools.ietf.org/html/draft-jain-kitten-krb-auth-indicator-00
>
> Please take a look at it and let me know if you have any feedback.

Hi Nathan,

I read through the draft, and it seems to be a useful feature to have -- 
right now at MIT, we have two-factor authentication enabled for some 
principals but not all of them, and applications wishing to ensure that 
only two-factor auth is used for access must use out-of-band methods to 
ensure that only two-factor-enabled (enabled == required, here) principals 
are on the ACL for the service.  Having a trusted piece of data from the 
KDC about how the initial authentication was performed seems like it would 
be helpful for services that want to ensure two-factor auth was used.

One minor note -- in the security considerations section, the element used 
to bind the contents of the CAMMAC to the enclosing ticket does have a 
name (AD-CAMMAC-BINDING), which should be used to concretely indicate what 
is being referred to.

The document could also benefit from a bit of editorial attention, but I 
did not note down the details (it is still a -00, after all).

-Ben