Re: [kitten] shepherd review of draft-ietf-kitten-krb-auth-indicator-02

[Nathaniel McCallum <[e-mail]>]

On Sun, 2016-09-25 at 19:20 -0400, Benjamin Kaduk wrote:
> I also suspect that the last paragraph of the security considerations
> should be rewritten in a normative fashion and moved to section 3, to
> make
> it clear what the presence of a given string in the authdata
> indicates.
> (Do we know of reasons why someone might use this AD element to
> indicate
> something other than a positive indication that the indicated
> requirements
> were met during the initial authentication?)

IMHO, I think this is not necessary. Section 3 already contains this
paragraph:

"Each UTF8String value is a short string that indicates that a
particular set of requirements was met during the initial
authentication."

This sentence is the normative definition of precisely what an
indicator is. The paragraph in the security considerations section is a
warning about what would happen if you tried to use indicators for
another purpose: ambiguity would arise. This is a security
consideration.

This warning is necessary precisely because the majority use of
indicators will be as site-defined strings.