Subject: [kitten] WGLC on draft-ietf-krb-wg-cammac-08

From: Shawn M Emery <[email-masked]>
Date: Mon, 07 Jul 2014 23:36:34 -0600

This message officially starts the kitten Working Group Last Call for the following document:
   
   Kerberos Authorization Data Container Authenticated by Multiple MACs
   http://tools.ietf.org/html/draft-ietf-krb-wg-cammac-08

The Working Group Last Call for this document starts today, on Monday, 7th of July and will end on Monday, 21st of July.

Please send any comments to the kitten mailing list or directly to the chairs.  Even if you reviewed this document
and found no issues then please provide this feed-back.

Thank you,

Shawn Emery
kitten co-chair
--

---

From: "Zheng, Kai" <[email-masked]>
Date: Tue, 8 Jul 2014 07:58:58 +0000

Could I post a minor comment? I'm just a beginning learner so apologize if I'm doing bad here and please kindly point me elsewhere, thanks. 

Regarding the following:
===
However, protocol extensions such as Constrained Delegation (S4U2Proxy
   [MS-SFU]) require that a service present to the KDC a service ticket
   that the service received from a client, as evidence that the client
   authenticated to the service.  In the S4U2Proxy extension, the KDC
   uses the evidence ticket as the basis for issuing a derivative ticket
   that the service can then use to impersonate the client.
===
Looks like the issue this draft targets to address mainly comes from MS-S4U2Proxy. As said in the MS-S4U doc, the S4U extension is intended to
be used when the user authenticates to the service in some way other than by using Kerberos. And in the S4U2Proxy flow,  service 1 requests
a service ticket to service 2 on behalf of the named user using a forwardable service ticket (or evidence ticket mentioned here). This forwardable 
service ticket might have been obtained by a KRB_AP_REQ and come from the user client (the case mentioned here), or by an S4U2self request (ignored 
here). IMHO, it might be better to rephrase the following sentence to make it more accurate.
===
... require that a service present to the KDC a service ticket that the service received from a client
===

Regards,
Kai

-----Original Message-----
From: Kitten [mailto:[email-masked]] On Behalf Of Shawn M Emery
Sent: Tuesday, July 08, 2014 1:37 PM
To: [email-masked]
Subject: [kitten] WGLC on draft-ietf-krb-wg-cammac-08

Please send any comments to the kitten mailing list or directly to the chairs.  Even if you reviewed this document and found no issues then please provide this feed-back.

Thank you,

Shawn Emery
kitten co-chair
--

_______________________________________________
Kitten mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/kitten