[kitten] I-D: Pseudonymity Support for Kerberos

[Rick van Rein <[e-mail]>]

Hello Kitten,

I've posted an I-D to support pseudonymity in Kerberos; I would like to
have this more refined privacy model for realm crossover to diminish
trust assumptions that need to be made on foreign realms.

Briefly put, pseudonyms can be applied during TGS, based on a KDC option
+ ticket flag.  When the ticket flag is set, the KDC is assumed to
support pseudonymity, and the cname field in TGS-REQ can be filled with
a requested client name; when left out, the KDC is given the permission
to apply pseudonymity if it feels like it.

Any comments on this are highly appreciated.

-Rick

> *From:* [e-mail]
> *Date:* 10 October 2015 09:37
> *To:* "Rick van Rein" <[e-mail]>
> *Subject:* New Version Notification for
> draft-vanrein-kitten-krb-pseudonymity-00.txt
> A new version of I-D, draft-vanrein-kitten-krb-pseudonymity-00.txt
> has been successfully submitted by Rick van Rein and posted to the
> IETF repository.
>
> Name:		draft-vanrein-kitten-krb-pseudonymity
> Revision:	00
> Title:		Pseudonymity Support for Kerberos
> Document date:	2015-10-10
> Group:		Individual Submission
> Pages:		7
> URL:            https://www.ietf.org/internet-drafts/draft-vanrein-kitten-krb-pseudonymity-00.txt
> Status:         https://datatracker.ietf.org/doc/draft-vanrein-kitten-krb-pseudonymity/
> Htmlized:       https://tools.ietf.org/html/draft-vanrein-kitten-krb-pseudonymity-00
>
>
> Abstract:
>    Kerberos either retains client identity in all its ticket
>    transformations, or it applies rigorous anonymity.  When crossing
>    over to another realm, an intermediate privacy measure is often
>    desired, namely pseudonymity, as described in this specification.
>
> The IETF Secretariat
>