Subject: [secdir] secdir review of draft-yount-krb-cred-clear-text-01.txt

From: Warren Kumari <[email-masked]>
Date: Mon, 8 Aug 2011 20:07:02 -0700

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.

These comments were written primarily for the benefit of the Security Area
Directors.  Document editors and WG chairs should treat these comments
just like any other last call comments.

This document formalizes the unencrypted form of the KRB-CRED message.

I am not a Kerberos expert (nor do I play one on TV) so this review is going to have limited value.

I am unclear as to whether there is a need for this facility -- there could be additional explanation and justification for why this is needed. Assuming that there is a need for this, the document seems well written.

The Security Considerations section outlines risks incurred by not having encryption, and specifies that this must only be used with a transport such as TLS that provides integrity and confidentiality. What is unclear from the security considerations section is that this transport must provide end to end security -- for example an IPSec VPN provides "a transport where sender and recipient identities can been established be known to each other and provides confidentiality and integrity.", but presumably the intent is that the encryption be between the applications -- IMO this should be clarified. 

I feel that there should advice provided regarding under what conditions use of this is appropriate -- but, than again, maybe this is obvious to someone who actually understands Kerberos :-P

Nit:
Section 3:
  s/MUST BE/MUST be/

W

---

From: Sam Hartman <[email-masked]>
Date: Thu, 18 Aug 2011 16:23:39 -0400

Hi.
I have one question about the. changes in the last rev.
Why exactly do we need end-to-end security?
Why would some protocol that provided sufficient hop-by-hop security,
for example an AAA transport with confidentiality and
draft-ietf-abfab-aaa-saml transporting a krb-cred message?

---

From: Sam Hartman <[email-masked]>
Date: Thu, 18 Aug 2011 18:23:15 -0400

>>>>> "Russell" == Russell J Yount <[email-masked]> writes:

    Russell> Sam, I was thinking an intermediate node resending a number
    Russell> KRB-CRED messages could substitute previously received
    Russell> KRB-CRED messages.

    Russell> Eg.  Node receives Joe's credentials and forwards Joe's
    Russell> credential.  Node receives Jill's credentials and forwards
    Russell> Joe's credential.  Whatever action Jill credentials where
    Russell> be used to perform now would be performed as Joe.

Right such can happen.
Part of hop-by-hop security is trusting the hops.
There are situations where this is appropriate and situations where it
is entirely inappropriate.

---

From: Russell J Yount <[email-masked]>
Date: Thu, 18 Aug 2011 21:24:14 +0000

Sam,

I was thinking an intermediate node resending a number KRB-CRED messages could substitute previously received KRB-CRED messages. 

Eg. 
   Node receives Joe's credentials and forwards Joe's credential.
   Node receives Jill's credentials and forwards Joe's credential.
Whatever action Jill credentials where be used to perform now would be performed as Joe.

Warren may have other thoughts on this.

-Russ

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Thursday, August 18, 2011 4:24 PM
To: Warren Kumari
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [secdir] secdir review of draft-yount-krb-cred-clear-text-01.txt

Hi.