Re: [kitten] Kerberos Service Discovery using DNS

[Rick van Rein <[e-mail]>]

Hi Nathaniel,

>> Please consider deprecating the SRV-based procedure; without 
>> deprecation, implementatations are pretty much convicted to 
>> implementing both mechanisms forevermore, which is silly from both 
>> KISS and security viewpoints.
> 
> Is there specific IETF language I need to use for this?

I don’t know of any, but the word “deprecated” seems to me to make a
big difference.  Formally, it’s still true of course that clients choose
whether to adopt any new standard into their code, but practically it
means that clients could get away with only implementing the new
approach.  For DNS admins, it would mean that they had to create
both descriptors because old clients won’t upgrade, but that hardly
sounds like a problem to me — except from the design ideal that
all knowledge should be concentrated in one place.

>> Please specify the implications for naming in certificates, such as 
>> for PKINIT.
> 
> I'm not sure how this relates.

I’m not sure if there is a problem, but it seems to be worthwhile to
consider.

SRV records point to a hostname, not an IP address.  This hostname
is then acceptable for certificates in many protocols — but I’m not
sure if that applies to the KDC’s certificates for PKINIT as well.
Note that an alternative is also possible, that is to require the domain
name to be used as a certificate name.  The fact that you define a
URI means that new habits / choices may follow, and especially if
the URI contains IP addresses instead of host names.

> Are you 
> suggesting that we need to document the security considerations of 
> using MS-KKDCP?

No.

>> Please do not overlool SCTP; it has the reliability and size-
>> scalability of TCP but the speed and ordering advantages of UDP.  
>> Even when Kerberos does not currently use SCTP, it may need to in 
>> future updates, possibly to handle large key sizes during PKINIT.
> 
> Since there is not currently an SCTP protocol defined, we cannot write 
> a method for discovering it. Feel free to work on one. :)

Hmm, yes this chicken-and-egg problem is everywhere where new
protocols are introduced, and it is generally considered valid reasoning.
I won’t press this hard, but think it leads to an impasse, which is why
I mentioned it; you are very specific about UDP and TCP and so you
are explicitly passing by SCTP.

-Rick