IETF Logo Mail Archive

Re: [kitten] [nfsv4] rpcsec-gssv3 multi-principal authentication

Nico Williams <nico@cryptonector.com> Thu, 04 September 2014 15:33 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BA8D1A0375; Thu, 4 Sep 2014 08:33:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.044
X-Spam-Level:
X-Spam-Status: No, score=-1.044 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y4H-I8mjtOxU; Thu, 4 Sep 2014 08:33:48 -0700 (PDT)
Received: from homiemail-a54.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) by ietfa.amsl.com (Postfix) with ESMTP id 856591A034A; Thu, 4 Sep 2014 08:33:48 -0700 (PDT)
Received: from homiemail-a54.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a54.g.dreamhost.com (Postfix) with ESMTP id 5C6D74012D68C; Thu, 4 Sep 2014 08:33:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h= mime-version:in-reply-to:references:date:message-id:subject:from :to:cc:content-type:content-transfer-encoding; s= cryptonector.com; bh=8y+ubvpTHQ1DplTDgelB408wOP4=; b=jYj/9h+7+Q9 rDpdj2nfU8MJeqI91dSgjWydqxViS7BUxvcA9+PN2n6Lz28LSbwprtP1kqvnreWp 2rcnrg7gzVE7cahqhJ42wZX3/MKUOwFYVL8LDYLF48WaCi72ocf1STTbvxdUzSod mT1iEqMAhPLPZX/vV1pmD2/0nOuKSjbA=
Received: from mail-wi0-f176.google.com (mail-wi0-f176.google.com [209.85.212.176]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by homiemail-a54.g.dreamhost.com (Postfix) with ESMTPSA id D9FF3400F8A2A; Thu, 4 Sep 2014 08:33:47 -0700 (PDT)
Received: by mail-wi0-f176.google.com with SMTP id bs8so1323854wib.9 for <multiple recipients>; Thu, 04 Sep 2014 08:33:46 -0700 (PDT)
MIME-Version: 1.0
X-Received: by 10.180.37.241 with SMTP id b17mr6749906wik.70.1409844826692; Thu, 04 Sep 2014 08:33:46 -0700 (PDT)
Received: by 10.216.231.131 with HTTP; Thu, 4 Sep 2014 08:33:46 -0700 (PDT)
In-Reply-To: <DD57BF66-1EB8-476E-B4C5-CD4FFB8AA401@netapp.com>
References: <alpine.GSO.1.10.1407311902230.21571@multics.mit.edu> <9BF7E3EA-59DB-4B91-A27A-659790AED727@netapp.com> <alpine.GSO.1.10.1408030153400.21571@multics.mit.edu> <alpine.GSO.1.10.1408201123060.21571@multics.mit.edu> <alpine.GSO.1.10.1409021306240.21571@multics.mit.edu> <20140903041240.GG2664@localhost> <20140903174741.GA24790@fieldses.org> <CAK3OfOipM10jM=e59q8hZd7niQGinQgWSBVFjKVabKRkvH1HUg@mail.gmail.com> <20140903192855.GA25363@fieldses.org> <CAK3OfOg9KSu7eK8a9zf24gJ92xegJhHvGXX1EEYhuPKE=Q87Vw@mail.gmail.com> <20140903194905.GB25363@fieldses.org> <alpine.GSO.1.10.1409031653010.21571@multics.mit.edu> <CAK3OfOhg8jSGECj-uAEh646Bw9Zb+oT_n8fwtHfk9HYvy30QkQ@mail.gmail.com> <DD57BF66-1EB8-476E-B4C5-CD4FFB8AA401@netapp.com>
Date: Thu, 04 Sep 2014 10:33:46 -0500
Message-ID: <CAK3OfOgxW-rOTamYnZFVw21BXLpO6cmuPi6VYnVHTVMrRSF1=Q@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: "Adamson, Andy" <William.Adamson@netapp.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: http://mailarchive.ietf.org/arch/msg/kitten/kps2XXUjUlSWKQlgvy4-wJ36C_c
Cc: "J. Bruce Fields" <bfields@fieldses.org>, "kitten@ietf.org" <kitten@ietf.org>, NFSv4 <nfsv4@ietf.org>
Subject: Re: [kitten] [nfsv4] rpcsec-gssv3 multi-principal authentication
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/kitten/>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 04 Sep 2014 15:33:49 -0000

On Thu, Sep 4, 2014 at 6:57 AM, Adamson, Andy
<William.Adamson@netapp.com> wrote:
>
> On Sep 3, 2014, at 5:17 PM, Nico Williams <nico@cryptonector.com> wrote:
>
>> On Wed, Sep 3, 2014 at 3:54 PM, Benjamin Kaduk <kaduk@mit.edu> wrote:
>>> On Wed, 3 Sep 2014, J. Bruce Fields wrote:
>>>> Sounds like there's work to do.
>>>
>>> I agree.
>>
>> I agree.  I wrote this eons ago and never got to implement.
>>
>> Multi-principal authentication is critical for security on multi-user
>> clients.  We should get it right.
>
> Yes. But! If we add more structure to prevent aliasing - e.g. attach it to a client machine (or clientid) then it will prevent it’s use in NFSv4.2 Inter server to server copy where the user principal on one client machine is permitting another client (the destination server acting as a client) to act on it’s behalf.

Huh?   I don't see the connection.

> I say we keep the current nonce and simply insist on privacy. This will prevent aliasing and yet allow ti’s only current use case.

That's too risky.

v2.29.0 | Report a Bug | By Email | System Status