IETF Logo Mail Archive

[Ietf-krb-wg] Kerberos error code 82 conflict in draft-ietf-krb-wg-pkinit-alg-agility-06

Tom Yu <tlyu@MIT.EDU> Tue, 06 November 2012 00:37 UTC

Return-Path: <ietf-krb-wg-bounces@lists.anl.gov>
X-Original-To: ietfarch-krb-wg-archive@ietfa.amsl.com
Delivered-To: ietfarch-krb-wg-archive@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A444111E80A5 for <ietfarch-krb-wg-archive@ietfa.amsl.com>; Mon, 5 Nov 2012 16:37:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.599
X-Spam-Level:
X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e96fQvI64y-B for <ietfarch-krb-wg-archive@ietfa.amsl.com>; Mon, 5 Nov 2012 16:37:38 -0800 (PST)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by ietfa.amsl.com (Postfix) with ESMTP id E147021F8514 for <krb-wg-archive@lists.ietf.org>; Mon, 5 Nov 2012 16:37:37 -0800 (PST)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by localhost.anl.gov (Postfix) with ESMTP id 595F5187; Mon, 5 Nov 2012 18:37:37 -0600 (CST)
Received: from lists.anl.gov (katydid.it.anl.gov [146.137.96.32]) by mailhost.anl.gov (Postfix) with ESMTP id A743015B; Mon, 5 Nov 2012 18:37:34 -0600 (CST)
Received: from katydid.it.anl.gov (localhost [127.0.0.1]) by lists.anl.gov (Postfix) with ESMTP id 79EB454C002; Mon, 5 Nov 2012 18:37:34 -0600 (CST)
X-Original-To: ietf-krb-wg@lists.anl.gov
Delivered-To: ietf-krb-wg@lists.anl.gov
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by lists.anl.gov (Postfix) with ESMTP id 780B554C001 for <ietf-krb-wg@lists.anl.gov>; Mon, 5 Nov 2012 18:37:33 -0600 (CST)
Received: by mailhost.anl.gov (Postfix) id 6ED027A; Mon, 5 Nov 2012 18:37:33 -0600 (CST)
Delivered-To: ietf-krb-wg@anl.gov
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by localhost.anl.gov (Postfix) with ESMTP id 68A7E15B for <ietf-krb-wg@anl.gov>; Mon, 5 Nov 2012 18:37:33 -0600 (CST)
Received: from mailrelay.anl.gov (mailrelay.anl.gov [130.202.101.22]) by mailhost.anl.gov (Postfix) with ESMTP id 491C47A for <ietf-krb-wg@anl.gov>; Mon, 5 Nov 2012 18:37:33 -0600 (CST)
Received: from localhost (localhost [127.0.0.1]) by localhost.it.anl.gov (Postfix) with ESMTP id 2EDEB7CC0B4; Mon, 5 Nov 2012 18:37:33 -0600 (CST)
Received: from mailrelay.anl.gov ([127.0.0.1]) by localhost (mailrelay.anl.gov [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 04170-06; Mon, 5 Nov 2012 18:37:33 -0600 (CST)
Received: from mailgateway.anl.gov (mailgateway.anl.gov [130.202.101.28]) by mailrelay.anl.gov (Postfix) with ESMTP id 120717CC08D for <ietf-krb-wg@anl.gov>; Mon, 5 Nov 2012 18:37:33 -0600 (CST)
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AsEBANNamFASB0QinGdsb2JhbABEsT8BkXMjAQEBAQEICwkJFCeCX3s0AYhtmVuYPIkIjBaDFoMlA4haoHKBRg
X-IronPort-AV: E=Sophos;i="4.80,719,1344229200"; d="scan'208";a="5376644"
Received: from dmz-mailsec-scanner-5.mit.edu ([18.7.68.34]) by mailgateway.anl.gov with ESMTP; 05 Nov 2012 18:37:32 -0600
X-AuditID: 12074422-b7f746d0000008cc-13-50985bcc0ac7
Received: from mailhub-auth-4.mit.edu ( [18.7.62.39]) by dmz-mailsec-scanner-5.mit.edu (Symantec Messaging Gateway) with SMTP id 61.9B.02252.CCB58905; Mon, 5 Nov 2012 19:37:32 -0500 (EST)
Received: from outgoing.mit.edu (OUTGOING-AUTH.MIT.EDU [18.7.22.103]) by mailhub-auth-4.mit.edu (8.13.8/8.9.2) with ESMTP id qA60bWLB020843 for <ietf-krb-wg@anl.gov>; Mon, 5 Nov 2012 19:37:32 -0500
Received: from cathode-dark-space.mit.edu (CATHODE-DARK-SPACE.MIT.EDU [18.18.1.96]) (authenticated bits=56) (User authenticated as tlyu@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.6/8.12.4) with ESMTP id qA60bUKn017614 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for <ietf-krb-wg@anl.gov>; Mon, 5 Nov 2012 19:37:31 -0500 (EST)
Received: (from tlyu@localhost) by cathode-dark-space.mit.edu (8.12.9.20060308) id qA60bU9B015598; Mon, 5 Nov 2012 19:37:30 -0500 (EST)
To: ietf-krb-wg@anl.gov
From: Tom Yu <tlyu@MIT.EDU>
Date: Mon, 05 Nov 2012 19:37:30 -0500
Message-ID: <ldv4nl3tvlh.fsf@cathode-dark-space.mit.edu>
Lines: 30
MIME-Version: 1.0
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrLIsWRmVeSWpSXmKPExsUixG6nrnsmekaAwfQDEhaTT05gcmD0OLnm LVsAYxSXTUpqTmZZapG+XQJXxpoJ19kKjnNWLLir3sD4jb2LkZNDQsBE4vPvU6wQtpjEhXvr 2UBsIYF9jBJftwV2MXIB2ScZJd52/maFcN4ySaydsw/K6WSUOL3gBCNIi4iAuETPr69gY4UF giVePlvI3MXIwcEmIC1xdHEZSJhFQFXiydTPYNt4BSwk/l7+xQRi8whwSjw6e5kJIi4ocXLm ExYQm1lAS+LGv5dMExj5ZiFJzUKSWsDItIpRNiW3Sjc3MTOnODVZtzg5MS8vtUjXVC83s0Qv NaV0EyM4lFyUdjD+PKh0iFGAg1GJh1dAbEaAEGtiWXFl7iFGSQ4mJVFejlCgEF9SfkplRmJx RnxRaU5q8SFGCQ5mJRFejjvTA4R4UxIrq1KL8mFS0hwsSuK811Ju+gsJpCeWpGanphakFsFk ZTg4lCR4t0QBDRUsSk1PrUjLzClBSDNxcIIM5wEaPgOkhre4IDG3ODMdIn+KUVFKnJcBGK1C AiCJjNI8uF5YrL9iFAd6RZh3CUg7DzBNwHW/AhrMBDR4+6UpIINLEhFSUg2MLj4d/s9ud87X Pt9YKveN4VzZ6+I89elBB/Or9PeW7H5Rwb3Y6ITvjx8B65TjbzLLPo0rC4yNnurZqnDW7KbT lnDHYuct8/jzJGJrGlecKVqpypXOcMXxtCa760sZeXtVfSEVT7lJj+bOPV6lwXXq6D7fcpdX wU7eboxz/n2sdt2TKLw09LgSS3FGoqEWc1FxIgBQS7+S0AIAAA==
X-Virus-Scanned: Debian amavisd-new at frigga.it.anl.gov
Subject: [Ietf-krb-wg] Kerberos error code 82 conflict in draft-ietf-krb-wg-pkinit-alg-agility-06
X-BeenThere: ietf-krb-wg@lists.anl.gov
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "This is a list for the IETF Kerberos Working Group. {WORLDPUB, EXTERNAL}" <ietf-krb-wg.lists.anl.gov>
List-Unsubscribe: <https://lists.anl.gov/mailman/options/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=unsubscribe>
List-Archive: <https://lists.anl.gov/pipermail/ietf-krb-wg>
List-Post: <mailto:ietf-krb-wg@lists.anl.gov>
List-Help: <mailto:ietf-krb-wg-request@lists.anl.gov?subject=help>
List-Subscribe: <https://lists.anl.gov/mailman/listinfo/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: ietf-krb-wg-bounces@lists.anl.gov
Sender: ietf-krb-wg-bounces@lists.anl.gov

For discussion tomorrow:

While I was going through my database of Kerberos number assignments
in preparation for handing off numbers to IANA, I found that there is
a conflict for error code 82.  draft-ietf-krb-wg-pkinit-alg-agility-06
has KDC_ERR_NO_ACCEPTABLE_KDF=82, while the published RFC 6111 has
KRB_AP_ERR_PRINCIPAL_UNKNOWN=82.

I'm not sure how this happened.  I tried to find e-mail relevant to
this assignment but could not.  (I haven't done a really extensive
search though.)  Unfortunately, I also see

error_code KRB5KDC_ERR_NO_ACCEPTABLE_KDF, "No acceptable KDF offered"

in the MIT krb5 code, which we seem to have some released code
referencing.  RFC 6111 seems to have priority, though:

2007-03-03 draft-ietf-krb-wg-naming-03
vs
2007-07-09 draft-ietf-krb-wg-pkinit-alg-agility-03

were the earliest versions of each that I could find.

What should we do about this?  Has anyone implemented anything that
uses KRB_AP_ERR_PRINCIPAL_UNKNOWN=82?

Sam has suggested that we overload the error code, because there
shouldn't be a situation where an unknown well-known principal name is
used in conjunction with PKINIT algorithm agility.  I think it's still
possible, but unlikely.
_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg@lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

v2.23.0 | Report a Bug | By Email