IETF Logo Mail Archive

Re: [Ietf-krb-wg] fast and patypes in KRB-ERROR

"Srinivas Cheruku" <srinivas.cheruku@gmail.com> Fri, 15 May 2009 06:59 UTC

Return-Path: <ietf-krb-wg-bounces@lists.anl.gov>
X-Original-To: ietfarch-krb-wg-archive@core3.amsl.com
Delivered-To: ietfarch-krb-wg-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1A4B23A6A50 for <ietfarch-krb-wg-archive@core3.amsl.com>; Thu, 14 May 2009 23:59:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.487
X-Spam-Level:
X-Spam-Status: No, score=-2.487 tagged_above=-999 required=5 tests=[AWL=0.113, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rFh48UuX+jlx for <ietfarch-krb-wg-archive@core3.amsl.com>; Thu, 14 May 2009 23:59:50 -0700 (PDT)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by core3.amsl.com (Postfix) with ESMTP id 10B0A3A69C0 for <krb-wg-archive@lists.ietf.org>; Thu, 14 May 2009 23:59:50 -0700 (PDT)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by localhost.ctd.anl.gov (Postfix) with ESMTP id A979C5C; Fri, 15 May 2009 02:01:23 -0500 (CDT)
Received: from lists.anl.gov (katydid.it.anl.gov [146.137.96.32]) by mailhost.anl.gov (Postfix) with ESMTP id 75F2961; Fri, 15 May 2009 02:01:20 -0500 (CDT)
Received: from katydid.it.anl.gov (localhost [127.0.0.1]) by lists.anl.gov (Postfix) with ESMTP id 10B9F80DFF; Fri, 15 May 2009 02:01:20 -0500 (CDT)
X-Original-To: ietf-krb-wg@lists.anl.gov
Delivered-To: ietf-krb-wg@lists.anl.gov
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by lists.anl.gov (Postfix) with ESMTP id 2E1CE80DF1 for <ietf-krb-wg@lists.anl.gov>; Fri, 15 May 2009 02:01:18 -0500 (CDT)
Received: by mailhost.anl.gov (Postfix) id 1EF655C; Fri, 15 May 2009 02:01:18 -0500 (CDT)
Delivered-To: ietf-krb-wg@anl.gov
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by localhost.ctd.anl.gov (Postfix) with ESMTP id 1A3B85D for <ietf-krb-wg@anl.gov>; Fri, 15 May 2009 02:01:18 -0500 (CDT)
Received: from mailrelay.anl.gov (mailrelay.anl.gov [130.202.101.22]) by mailhost.anl.gov (Postfix) with ESMTP id F1B115C for <ietf-krb-wg@anl.gov>; Fri, 15 May 2009 02:01:17 -0500 (CDT)
Received: from localhost (localhost [127.0.0.1]) by localhost.it.anl.gov (Postfix) with ESMTP id DB6A17CC121; Fri, 15 May 2009 02:01:17 -0500 (CDT)
Received: from mailrelay.anl.gov ([127.0.0.1]) by localhost (mailrelay.anl.gov [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 14835-10; Fri, 15 May 2009 02:01:17 -0500 (CDT)
Received: from mailgateway.anl.gov (mailgateway.anl.gov [130.202.101.28]) by mailrelay2.anl.gov (Postfix) with ESMTP id BC6987CC067 for <ietf-krb-wg@anl.gov>; Fri, 15 May 2009 02:01:17 -0500 (CDT)
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AqACAEewDErRVdvXmGdsb2JhbACWdz8BAQEBAQgJDAcRpWiBEo98AQMBA4QBBYgi
X-IronPort-AV: E=Sophos;i="4.41,198,1241413200"; d="scan'208";a="27044847"
Received: from mail-ew0-f215.google.com ([209.85.219.215]) by mailgateway.anl.gov with ESMTP; 15 May 2009 02:01:17 -0500
Received: by ewy11 with SMTP id 11so2219153ewy.19 for <ietf-krb-wg@anl.gov>; Fri, 15 May 2009 00:01:16 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:to:cc:references :in-reply-to:subject:date:message-id:mime-version:content-type :content-transfer-encoding:x-mailer:thread-index:content-language; bh=Qd/1zS2fgGER76pwa/nN+5ObKnskAU7pRmV6HGYwN3A=; b=B9yu9cz3vt6QBYph1J94d8GuCCX3coqyBcy+Cu+LAAzq/bAFiqPQxfEP2R2h2sE7sv OXkpeWMKaFVwkk2iiS04mAKOw9dpLOQVaiDzIIpH98wGnQaKTmDJpgBK1PN2cehdzOlM 7Kyq+0Dro9F8SxB/RMxbyDZtiiCaJHym+1Wzs=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:references:in-reply-to:subject:date:message-id :mime-version:content-type:content-transfer-encoding:x-mailer :thread-index:content-language; b=kP0yB3av/1HgZoO/i+eR3fIi7NIvMJ1D0V5VJKuCBgEUQgMd8HwR6LLl66sxY6Ndhu PUQTwA2Q4UCXOUHNPbdSA9r/Q9hm/rV1VwOqZYQdVLZ/eRy24pvF7HCu8pjUcECBjWbz yAxxVQ6ekj4NJ71DfewAfVzxSlYheU9MeNTzQ=
Received: by 10.210.13.17 with SMTP id 17mr2874071ebm.83.1242370876460; Fri, 15 May 2009 00:01:16 -0700 (PDT)
Received: from vistascheruku ([122.166.4.6]) by mx.google.com with ESMTPS id 23sm1233584eya.59.2009.05.15.00.01.13 (version=TLSv1/SSLv3 cipher=RC4-MD5); Fri, 15 May 2009 00:01:14 -0700 (PDT)
From: Srinivas Cheruku <srinivas.cheruku@gmail.com>
To: 'Sam Hartman' <hartmans-ietf@mit.edu>
References: <1A136DCE57F98F4B8BAB5FFC69C8E6DA21E59BDCD7@exchange.cybersafe.local> <tslskj7w8n0.fsf@mit.edu>
In-Reply-To: <tslskj7w8n0.fsf@mit.edu>
Date: Fri, 15 May 2009 12:31:05 +0530
Message-ID: <4a0d133a.1701d00a.65de.ffff9802@mx.google.com>
MIME-Version: 1.0
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AcnU7jAJWP4VThoQTcqcj2gUYLGL+QAOslGg
Content-Language: en-in
X-Virus-Scanned: Debian amavisd-new at frigga.it.anl.gov
Cc: ietf-krb-wg@anl.gov, "'krbdev@mit.edu'" <krbdev@MIT.EDU>
Subject: Re: [Ietf-krb-wg] fast and patypes in KRB-ERROR
X-BeenThere: ietf-krb-wg@lists.anl.gov
X-Mailman-Version: 2.1.11
Precedence: list
List-Id: "This is a list for the IETF Kerberos Working Group. {WORLDPUB, EXTERNAL}" <ietf-krb-wg.lists.anl.gov>
List-Unsubscribe: <https://lists.anl.gov/mailman/options/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=unsubscribe>
List-Archive: <https://lists.anl.gov/pipermail/ietf-krb-wg>
List-Post: <mailto:ietf-krb-wg@lists.anl.gov>
List-Help: <mailto:ietf-krb-wg-request@lists.anl.gov?subject=help>
List-Subscribe: <https://lists.anl.gov/mailman/listinfo/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: ietf-krb-wg-bounces@lists.anl.gov
Errors-To: ietf-krb-wg-bounces@lists.anl.gov

Sam wrote:...
>Probably this is more of an IETF issue than an MIT issue.  My concern
>about doing this is that the negotiation of which fast factors are
>supported would be unprotected.

[Srinivas Cheruku] I was thinking on this more. 
What affect would it have if the negotiation of fast factors is not
protected? 
When non-fast request is sent to KDC, it returns KRB-ERROR e-data containing
PA-FX-FAST. This is also not protected PA-FX-FAST can also be deleted from
initial unprotected error. If this happens, the client would send non-fast
request containing enc-timestamp instead of generating a fast request. It
depends on the KDC policy to allow non-fast requests or not.

If we take the case of adding PA-ENCRYPTED-CHALLENGE or PA-OTP-CHALLENGE
along with PA-FX-FAST to unprotected error, then if these are deleted in
transit, then client maynot send OTP or ENC-CHALLENGE, but if the KDC is
configured so that the client requires these, then it won't generate the
ticket and would again asks for the same.

So, where do we see a potential risk of sending PA-ENCRYPTED-CHALLENGE or
PA-OTP-CHALLENGE along with PA-FX-FAST in unprotected error. Am I
overlooking something?

Thanks,
Srini



_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg@lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

v2.23.0 | Report a Bug | By Email