Re: [TLS] I-D: CipherSuites for Kerberos + DH

[Rick van Rein <[e-mail]>]

Hello Benjamin,

> This would seem to require an application protocol doing some Kerberos
> exchanges up front to establish the Kerberos session key before pivoting
> into TLS-PSK in a STARTLS-esque fashion. If that's what the application
> protocol would look like, it seems like there's no reason not to go
> full-on GSSAPI with GSS_Pseudo_random to extract a PSK on both sides.

GSSAPI is too general IMHO; it specifies an unpredictable number of exchanges 
and TLS cannot carry that.

An attempt for SASL-in-TLS was made in draft-williams-tls-app-sasl-opt, but it 
ends up piggybacking on TLS but continue afterwards -- loosing the cryptographic 
binding between auth from Kerberos with PFS from (EC)DH.

> This proposal (as complicated as it is, and I'm not sure that I'm
> entirely comfortable with it yet) has the comparative advantage that the
> application speaks TLS from the start, with the Kerberos messages
> included in the TLS CKE. In that sense, at least, it is elegant.

Thanks. The proposed changes greatly simplify the spec, making all DH orthogonal 
to the spec.  Watson convinced me and now I can pull a lot from the I-D, which
is also more complex than I like.

> This proposal also includes a generic mechanism for the server to
> indicate what service type and hostname should be used in constructing
> the host-based service principal name for Kerberos, which is useful --
> the convention for that would otherwise have to be baked into the
> application protocol.
>

Actually, I did not specify such a mechanism.
* Client and server assume that the application context knows what protocol it 
  is using. AFAIK that always makes sense -- on top of TLS we're running something 
  like imap, and imap knows that its tickets start with "imap/".
* The hostname is known to the client too, it is usually included in the SNI 
  extension, looked up in DNS, ...
* However, the realm is "supposed to be derived independently" which can be done
  with the DNSSEC-assured _kerberos TXT that we discussed on Kitten.

> The considerations around client anonymity and a
> protocol for the server to convey its expectations are also interesting,
> though I'm not sure I would have put it in the -00 if it was my own
> document.

OK :) but this was simpler than the loose end in predecessors -- sending no
ticket and deciding how the server would respond to that.  But it is a new
idea, to have authenticated clients with unknown identities...

> There are some nits in the Kerberos bits that I might mention over on
> kitten.

Great, thanks!

-Rick