Re: [kitten] Fwd: New Version Notification for draft-vanrein-dnstxt-krb1-05.txt

[Viktor Dukhovni <[e-mail]>]

On Fri, Sep 18, 2015 at 09:02:48AM -0500, Nico Williams wrote:

> I'm very reluctant to agree to that, but I'd agree to saying that a TGS
> client should first try the realm as it appears in the PTR RR and then
> as up-cased if the first failed.

What does it mean to "try the realm"?

    * If it is a case variant of the local realm, just use the local realm.

    * If it is a case variant of a realm for which you already have
      cross-realm TGT or a service ticket for the desired service,
      use that.

    * If capaths are configured, for a case-variant of the realm,
      use that.

    * Otherwise, referrals with the KDC locating a suitable next
      realm based on capaths or a direct "trust" relationship.

The only time that determining the canonical form of the remote
realm becomes plausibly difficult, is when trust is constructed on
the fly via public keys in DNSSEC.  When such a protocol is designed,
the canonical realm suffix can be communicated as part of the
authenticated cross-realm key exchange.

So I don't see any need for "guessing" the realm name, rather all
that's required is that KDCs be able to locate cross-realm keys in
a "case-insensitive" manner (more precisely, if two realm names
represent the same valid DNS name, then each matches the other)
and that clients accept KDC responses in which the KDC has
canonicalized the requested realm name.

> The only thing that concerns me is how to canonicalize realm names for
> name-based authorization.  This is the case where an AS client used an
> alias realm name and now cannot get authorized to access some resources.

I don't expect that AS clients will be getting the realm name for
"kinit" from DNS.  If you want to "kinit" to a realm other than
the realm of the local host, I expect you need to know its name.

In any case the realm is (generally) part of the salt in string-to-key,
so it would seem that AS is not possible with a variant realm.

-- 
	Viktor.