Re: [secdir] SECDIR review of draft-ietf-kitten-krb-auth-indicator-04

Nathaniel McCallum <npmccallum@redhat.com> Thu, 05 January 2017 20:39 UTC

MIME-Version: 1.0
In-Reply-To: <042f01d26790$e936a5f0$bba3f1d0$@huitema.net>
References: <005f01d263d5$84b14680$8e13d380$@huitema.net> <006f01d263d8$435dc430$ca194c90$@huitema.net> <20170103062001.GN8460@kduck.kaduk.org> <00c901d26766$566e9ae0$034bd0a0$@huitema.net> <20170105194728.GU8460@kduck.kaduk.org> <042f01d26790$e936a5f0$bba3f1d0$@huitema.net>
From: Nathaniel McCallum <npmccallum@redhat.com>
Date: Thu, 05 Jan 2017 15:39:36 -0500
Message-ID: <CAOASepOE2RHGoZre7g6xswX56AUPZJfPMkksHWt7rwBo6_C-sw@mail.gmail.com>
To: Christian Huitema <huitema@huitema.net>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/VCEmKEb5O4Nwc1e3Vh0YygMIZU4>
Cc: secdir <secdir@ietf.org>, draft-ietf-kitten-krb-auth-indicator.all@ietf.org, "Kinder, Nathan" <nkinder@redhat.com>, kitten@ietf.org, IESG <iesg@ietf.org>
Subject: Re: [secdir] SECDIR review of draft-ietf-kitten-krb-auth-indicator-04
Precedence: list

On Thu, Jan 5, 2017 at 3:18 PM, Christian Huitema <huitema@huitema.net> wrote:
> On Thursday, January 5, 2017 11:47 AM, Benjamin Kaduk wrote:
>>
>> Thanks for finding the new document -- I was going to send you a pointer
>> today to confirm that it addressed your concerns, but you beat me to it.
>
> Blame Tero Kivinen. He sent me a reminder this morning.
>
>>> One point, though. The new section 4 states:
>>>
>>>    o  The table in Section 5.2.6 of RFC 4120 [RFC4120] is updated to map
>>>       the ad-type 97 to "DER encoding of AD-AUTHENTICATION-INDICATOR".
>>>
>>> Should that not be "DER encoding of AD-AUTHENTICATION-INDICATOR wrapped
> in a
>>> CAMMAC container"?
>>
>> I don't think so, but will loop in the WG to confirm.
>> The ad-type should indicate what is immediately inside the next encoding
>> layer of the ad-data.  So a Ticket might have an AuthorizationData that
>> contains ad-type 1 (AD-IF-RELEVANT), that itself contains
> AuthorizationData
>> with ad-type 96 (AD-CAMMAC), that in turn contains AuthorizationData with
>> ad-type 97 (AD-AUTHENTICATION-INDICATOR).  So, 97 should appear only at
>> the lowest level, and correspond to ad-data that's just the
>> AD-AUTHENTICATION-INDICATOR itself.
>
> OK, I get that now. It was not entirely obvious from reading the text.
>
> What is supposed to happen if the outside Authorization Data type is set to
> 97 instead of 96? Should that be specified somewhere? The text says:
>
>    Authorization data elements of type AD-AUTHENTICATION-INDICATOR MUST
>    be included in an AD-CAMMAC container so that their contents can be
>    verified as originating from the KDC.
>
> That's a fine constraint for the sender, but what about receivers?

5.  Security Considerations

   ... Application servers MUST validate the AD-CAMMAC container before
   making authorization decisions based on AD-AUTHENTICATION-INDICATOR
   elements.  Application servers MUST NOT make authorization decisions
   based on AD-AUTHENTICATION-INDICATOR elements which appear outside of
   AD-CAMMAC containers. ...

[secdir] SECDIR review of draft-ietf-kitten-krb-a… Christian Huitema
Re: [secdir] SECDIR review of draft-ietf-kitten-k… Christian Huitema
Re: [secdir] SECDIR review of draft-ietf-kitten-k… Benjamin Kaduk
Re: [secdir] SECDIR review of draft-ietf-kitten-k… Christian Huitema
Re: [secdir] SECDIR review of draft-ietf-kitten-k… Benjamin Kaduk
Re: [secdir] [kitten] SECDIR review of draft-ietf… Greg Hudson
Re: [secdir] SECDIR review of draft-ietf-kitten-k… Christian Huitema
Re: [secdir] SECDIR review of draft-ietf-kitten-k… Nathaniel McCallum
Re: [secdir] SECDIR review of draft-ietf-kitten-k… Christian Huitema