Re: [kitten] I-D Action: draft-ietf-krb-wg-cammac-09.txt

[Greg Hudson <[e-mail]>]

On 09/08/2014 12:29 PM, Benjamin Kaduk wrote:
> Aside from the extra "be" (in "be use") that Simo pointed out on IRC, I am
> still not sure that I understand the last paragraph of the security
> considerations.  That is, I don't see how using the S4U2Proxy extension
> and having policy disallow the use of S4U2Proxy would result in similar
> security properties.

I tihnk the extra "be" is supposed to be "not" or "never".

I suggest changing:

    The KDC MAY create a new CAMMAC from an existing CAMMAC	
    lacking a kdc-verifier if it is inserting the new CAMMAC into a	
    service ticket for the same service principal as the ticket that	
    contained the existing CAMMAC, and if all of the realm's KDCs are	
    configured to reject S4U2Proxy requests made by that service	
    principal.

to instead say, "... as the ticket that contained the existing CAMMAC,
but MUST NOT place a kdc-verifier in the new CAMMAC."  This is simpler
to implement.  By not putting a kdc-verifier in the new CAMMAC, we don't
risk treating the new CAMMAC contents as definitively KDC-originated for
a subsequent S4U2Proxy request if the policy changes.