Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[Viktor Dukhovni <[e-mail]>]

On Tue, Sep 15, 2015 at 05:11:07PM +0200, Rick van Rein wrote:

> Hi Vik,

That's not my name.

> There is another reason to prefer a binary format, and that is to leave
> the door ajar for future i18n attempts of Kerberos realm names.  That is
> hard enough as it is now, without having to deal with DNS i18n as well.

Well, names that are i18n, but don't map into DNS are not going to
do anyone much good.  They need to be avoided.  It is precisely
*because* PTR constrains you to valid A-labels, that it is the right
way to map realms into DNS.

> > It it *exactly* the meaning you have in mind.  A DNS name that is
> > not an alias.  A pointer to another place in the DNS.
> 
> Assuming a Kerberos realm from a DNS name is not automatically safe
> because it may not be intended as such by the DNS zone operator /
> signer.  Because not all DNS names are intended to be, or have Kerberos
> realms.  That is the problem with overloaded / mind-read types that also
> have anohter life.

I'm not assuming anything.  I proposing that:

	_kerberos.host.example.com. IN PTR EXAMPLE.COM.

mean that the realm of "host.example.com" is "EXAMPLE.COM".  If
this mapping sometimes loses case, it may well be time to consider
defining the realm portion of Kerberos principals to be case-insensitive
for A-labels, and for non-ASCII names (as with IDNA 2008) *required*
to be effectively lower-case for U-labels.

The realm is going to be used for SRV lookups, and needs to be
valid DNS name.  Also the realm should be case-insensitive anyway,
time to bite that bullet.


> I would like to hear if i18n experts agree to such mappings.  And
> especially in the context of Kerberos, where we are dealing with older
> applications that were a bit too liberal with what they put into their
> realm name fields.

They don't all have to use DNS for realm mappings, they've gotten
by without so far.

> > Kerberos realms in DNS should be DNS names,
> 
> I've found that people in the Kerberos community treat old habits as
> things that die hard.  What you are saying probably applies to 99% of
> the users, but I see no point to forbid other forms of realm name in
> DNS.

I am proposing leaving legacy behind here, because we don't break
anything by not carrying it forward into DNS.

Of course you could simply standardize the current informal

    _kerberos.host.example.com. IN TXT "EXAMPLE.COM"

that'd be even more backwards compatible.  I already have a large
install-base of those.  And yet I think that PTR makes more sense
in the long run.  I see no compelling reason for KREALM.

-- 
	Viktor.