IETF Logo Mail Archive

Re: [Ietf-krb-wg] Kerberos error code 82 conflict in draft-ietf-krb-wg-pkinit-alg-agility-06

Simo Sorce <simo@redhat.com> Tue, 06 November 2012 13:43 UTC

Return-Path: <ietf-krb-wg-bounces@lists.anl.gov>
X-Original-To: ietfarch-krb-wg-archive@ietfa.amsl.com
Delivered-To: ietfarch-krb-wg-archive@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9854B21F867B for <ietfarch-krb-wg-archive@ietfa.amsl.com>; Tue, 6 Nov 2012 05:43:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.599
X-Spam-Level:
X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8aWoyutTZ--7 for <ietfarch-krb-wg-archive@ietfa.amsl.com>; Tue, 6 Nov 2012 05:43:42 -0800 (PST)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by ietfa.amsl.com (Postfix) with ESMTP id E582921F84A5 for <krb-wg-archive@lists.ietf.org>; Tue, 6 Nov 2012 05:43:41 -0800 (PST)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by localhost.anl.gov (Postfix) with ESMTP id 6F1DF11; Tue, 6 Nov 2012 07:43:41 -0600 (CST)
Received: from lists.anl.gov (katydid.it.anl.gov [146.137.96.32]) by mailhost.anl.gov (Postfix) with ESMTP id 85EA425; Tue, 6 Nov 2012 07:43:39 -0600 (CST)
Received: from katydid.it.anl.gov (localhost [127.0.0.1]) by lists.anl.gov (Postfix) with ESMTP id 60A748106B; Tue, 6 Nov 2012 07:43:39 -0600 (CST)
X-Original-To: ietf-krb-wg@lists.anl.gov
Delivered-To: ietf-krb-wg@lists.anl.gov
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by lists.anl.gov (Postfix) with ESMTP id BA95D81066 for <ietf-krb-wg@lists.anl.gov>; Tue, 6 Nov 2012 07:43:38 -0600 (CST)
Received: by mailhost.anl.gov (Postfix) id 3C4241CD; Tue, 6 Nov 2012 07:43:38 -0600 (CST)
Delivered-To: ietf-krb-wg@anl.gov
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by localhost.anl.gov (Postfix) with ESMTP id 87BE51B9 for <ietf-krb-wg@anl.gov>; Tue, 6 Nov 2012 07:43:27 -0600 (CST)
Received: from mailrelay.anl.gov (mailrelay.anl.gov [130.202.101.22]) by mailhost.anl.gov (Postfix) with ESMTP id D321E11 for <ietf-krb-wg@anl.gov>; Tue, 6 Nov 2012 07:43:26 -0600 (CST)
Received: from localhost (localhost [127.0.0.1]) by localhost.it.anl.gov (Postfix) with ESMTP id BA87F7CC0B5; Tue, 6 Nov 2012 07:43:26 -0600 (CST)
Received: from mailrelay.anl.gov ([127.0.0.1]) by localhost (mailrelay.anl.gov [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 16557-01; Tue, 6 Nov 2012 07:43:26 -0600 (CST)
Received: from mailgateway.anl.gov (mailgateway.anl.gov [130.202.101.28]) by mailrelay.anl.gov (Postfix) with ESMTP id 9648E7CC094 for <ietf-krb-wg@anl.gov>; Tue, 6 Nov 2012 07:43:24 -0600 (CST)
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: Ai0CABETmVDRhLcclGdsb2JhbABEDoYJvRgjAQEBAQkLCQkUBiGCHgEBAQEDI1YQCw4KAgImAgJXBogdqHiCPJBRgSCKfYUogRMDiFqTDI0LW4FG
X-IronPort-AV: E=Sophos;i="4.80,722,1344229200"; d="scan'208";a="5405240"
Received: from mx1.redhat.com ([209.132.183.28]) by mailgateway.anl.gov with ESMTP; 06 Nov 2012 07:43:23 -0600
Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id qA6DhMHF013587 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 6 Nov 2012 08:43:22 -0500
Received: from [10.3.113.95] (ovpn-113-95.phx2.redhat.com [10.3.113.95]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id qA6DhL9w005163; Tue, 6 Nov 2012 08:43:22 -0500
From: Simo Sorce <simo@redhat.com>
To: Tom Yu <tlyu@MIT.EDU>
In-Reply-To: <ldv4nl3tvlh.fsf@cathode-dark-space.mit.edu>
References: <ldv4nl3tvlh.fsf@cathode-dark-space.mit.edu>
Organization: Red Hat, Inc.
Date: Tue, 06 Nov 2012 08:43:21 -0500
Message-ID: <1352209401.10327.47.camel@willson.li.ssimo.org>
Mime-Version: 1.0
X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22
X-Virus-Scanned: Debian amavisd-new at frigga.it.anl.gov
Cc: ietf-krb-wg@anl.gov
Subject: Re: [Ietf-krb-wg] Kerberos error code 82 conflict in draft-ietf-krb-wg-pkinit-alg-agility-06
X-BeenThere: ietf-krb-wg@lists.anl.gov
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "This is a list for the IETF Kerberos Working Group. {WORLDPUB, EXTERNAL}" <ietf-krb-wg.lists.anl.gov>
List-Unsubscribe: <https://lists.anl.gov/mailman/options/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=unsubscribe>
List-Archive: <https://lists.anl.gov/pipermail/ietf-krb-wg>
List-Post: <mailto:ietf-krb-wg@lists.anl.gov>
List-Help: <mailto:ietf-krb-wg-request@lists.anl.gov?subject=help>
List-Subscribe: <https://lists.anl.gov/mailman/listinfo/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: ietf-krb-wg-bounces@lists.anl.gov
Sender: ietf-krb-wg-bounces@lists.anl.gov

On Mon, 2012-11-05 at 19:37 -0500, Tom Yu wrote:
> For discussion tomorrow:
> 
> While I was going through my database of Kerberos number assignments
> in preparation for handing off numbers to IANA, I found that there is
> a conflict for error code 82.  draft-ietf-krb-wg-pkinit-alg-agility-06
> has KDC_ERR_NO_ACCEPTABLE_KDF=82, while the published RFC 6111 has
> KRB_AP_ERR_PRINCIPAL_UNKNOWN=82.
> 
> I'm not sure how this happened.  I tried to find e-mail relevant to
> this assignment but could not.  (I haven't done a really extensive
> search though.)  Unfortunately, I also see
> 
> error_code KRB5KDC_ERR_NO_ACCEPTABLE_KDF, "No acceptable KDF offered"
> 
> in the MIT krb5 code, which we seem to have some released code
> referencing.  RFC 6111 seems to have priority, though:
> 
> 2007-03-03 draft-ietf-krb-wg-naming-03
> vs
> 2007-07-09 draft-ietf-krb-wg-pkinit-alg-agility-03
> 
> were the earliest versions of each that I could find.
> 
> What should we do about this?  Has anyone implemented anything that
> uses KRB_AP_ERR_PRINCIPAL_UNKNOWN=82?
> 
> Sam has suggested that we overload the error code, because there
> shouldn't be a situation where an unknown well-known principal name is
> used in conjunction with PKINIT algorithm agility.  I think it's still
> possible, but unlikely.

If it is the error I thin it is I think we use that error code in
FreeIPA to detect when some users need migration.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg@lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

v2.23.0 | Report a Bug | By Email