Subject: Re: comments on draft-ietf-cat-krb-dns-locate-02.txt

From: Jeffrey Altman <[email-masked]>
Date: Wed, 15 Mar 2000 15:46:01 EST

> The second is, would the administrator of foobar.ibm.com really have
> the ability to create entries under "=i=b=m.=c=o=m." for other sites
> to see?  I don't think so.  And, as you say, TXT response data is
> case-preserving, so it's only in the query that this matters.

You know.  That is a very good point.  This is what I get for drinking
too much DrPepper in order to counter balance the lack of sleep.

Clearly, this won't work, and yes.  I now agree with you.  Upper case
realm names only.  Of course, this is going to break the default names
that Windows 2000 generates, but ....

> Security issues: The second exploit described is an exploit of the MIT
> implementation, not the Kerberos design.  The Kerberos model itself
> provides no way of determining the realm of a host.  In fact, I don't
> think it makes any requirement that multiple services running on a
> single host (even without multiple hostnames etc) use the same local
> realm.

The problem is that there needs to be a way for the realm of a host to
be determined.  That is why the DNS TXT record is used; and why MIT
placed host/domain to realm mappings into the config files.  Of
course, the Kerberos model does not provide any description of how
this should be done because from the authentication perspective it is 
not necessary.  But because these mappings are necessary and we do not
have secure way of performing them, the exploit is an issue for all 
Kerberos implementations.  Of course, if no host to realm mappings
provided the exploit goes away.

> 
> A random thought: You mention both krb4 and krb5 in the abstract, but
> do we have any way of distinguishing a v4-only vs v5-only vs v4+v5
> site without having the info stored locally?

No.  There is nothing to distinguish a K4 KDC from a K5 KDC, and from
my experience at Columbia there is no need to.  We distributed 10,000
clients last Fall to users that supported K4 and K5 when our KDC was
K4 only.  In December, we switched from K4 to K5 1.1 without the users
even noticing.  The only thing that changed was that they now got both
K4 and K5 tickets when they used Leash32.

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: John Brezak <[email-masked]>
Date: Wed, 15 Mar 2000 16:48:06 -0800

All Kerberos realm names for Windows 2000 domains are uppercase because they
are DNS names.

> -----Original Message-----
> From: Jeffrey Altman [mailto:[email-masked]]
> Sent: Wednesday, March 15, 2000 12:46 PM
> To: Ken Raeburn
> Cc: [email-masked]
> Subject: Re: comments on draft-ietf-cat-krb-dns-locate-02.txt
> 
> 
>

---

From: Jeffrey Altman <[email-masked]>
Date: Wed, 15 Mar 2000 20:00:28 EST

> All Kerberos realm names for Windows 2000 domains are uppercase because they

I'm not sure I understand this.  How does a name being a DNS name
result in it being an upper case realm name?

I made my comment based on the fact that when I installed Win2000
it defaulted to a realm name with only upper cased first characters of
each segment.  But perhaps that was just the user presentation and you
always uppercase behind the scenes.

---

From: John Brezak <[email-masked]>
Date: Wed, 15 Mar 2000 17:21:54 -0800

As per kerberos-revisions, "... (DNS) Domain names must be converted to
uppersace when used as realm names." Since a Windows 2000 domain name is a
DNS domain name, we follow this rule.

When using a Windows 2000 domain name as a realm, it is always used in its
uppercase form. Internally we preserve the case that was typed when it was
created, but we aren't case sensitive. When using the domain name in UI, we
use the "typed" case.

> Sent: Wednesday, March 15, 2000 5:00 PM
> To: John Brezak
> Cc: Ken Raeburn; [email-masked]
> Subject: RE: comments on draft-ietf-cat-krb-dns-locate-02.txt
> 
>