Re: [secdir] SECDIR review of draft-ietf-kitten-krb-auth-indicator-04

["Christian Huitema" <[e-mail]>]

On Thursday, January 5, 2017 11:47 AM, Benjamin Kaduk wrote:
>
> Thanks for finding the new document -- I was going to send you a pointer
> today to confirm that it addressed your concerns, but you beat me to it.

Blame Tero Kivinen. He sent me a reminder this morning.

>> One point, though. The new section 4 states:
>> 
>>    o  The table in Section 5.2.6 of RFC 4120 [RFC4120] is updated to map
>>       the ad-type 97 to "DER encoding of AD-AUTHENTICATION-INDICATOR".
>> 
>> Should that not be "DER encoding of AD-AUTHENTICATION-INDICATOR wrapped
in a
>> CAMMAC container"?
> 
> I don't think so, but will loop in the WG to confirm.
> The ad-type should indicate what is immediately inside the next encoding
> layer of the ad-data.  So a Ticket might have an AuthorizationData that
> contains ad-type 1 (AD-IF-RELEVANT), that itself contains
AuthorizationData
> with ad-type 96 (AD-CAMMAC), that in turn contains AuthorizationData with
> ad-type 97 (AD-AUTHENTICATION-INDICATOR).  So, 97 should appear only at
> the lowest level, and correspond to ad-data that's just the
> AD-AUTHENTICATION-INDICATOR itself.

OK, I get that now. It was not entirely obvious from reading the text.

What is supposed to happen if the outside Authorization Data type is set to
97 instead of 96? Should that be specified somewhere? The text says:

   Authorization data elements of type AD-AUTHENTICATION-INDICATOR MUST
   be included in an AD-CAMMAC container so that their contents can be
   verified as originating from the KDC.

That's a fine constraint for the sender, but what about receivers?

-- Christian Huitema