Re: [kitten] ID-Action: draft-williams-kitten-krb5-pkcross-01

[Benjamin Kaduk <[e-mail]>]

Forgot to note: you cite draft-hotz-kx509-06, but it is RFC 6717, now.

On Fri, 9 Aug 2013, Benjamin Kaduk wrote:

> [again no in-reply-to, sorry]
>
> I've looked over this document, though I did not do a full-depth review of 
> it.
>
> The scheme is intellectually appealing, or at least amusing, and on paper it 
> seems to help with the issues related to cross-realm trusts.  I just can't 
> shake the feeling that it won't be adopted in the real world, though, and I'm 
> not sure why.  This makes me reluctant to spend much time trying to move it 
> forward without some indication that it would gain traction.
>
> Another reason for reluctance is that the propsal wants one of the 
> relatively-scarce KDCOptions flag bits.
>
> It looks like USE-SESSION-KEY-AS-REALM-KEY will only do one direction of 
> trust (at a time)?  So a bidirectional trust would still require initiation 
> from both sides (as it should).  It might be worth mentioning that 
> explicitly, even though it follows directly from the directions of trust 
> having different principal names.
>
> In section 2.1, I don't really understand the motivation for (d).
>
> Section 3 makes me wonder if there is some discussion to be had about the KDC 
> allowing/disallowing itself of making signatures of users' PKCROSS 
> certificates when there does exist a symmetric key between the realms. That 
> is, allowing new certs to be signed would preserve the privacy property, but 
> requires more work (?) and reduces auditability.
>
> In section 4, there might be something to be said about setting 
> TRANSITED-POLICY-CHECKED for a cached/post-LoF trust, after some threshold 
> has passed (wall time without changed cert, or number of successful requests, 
> or something).
>
> -Ben
>