Subject: Re: comments on krb-dns-locate draft

From: Jeffrey Altman <[email-masked]>
Date: Tue, 23 Nov 99 16:41:19 EST

> The user asks the KDC which it originally obtained its TGT from in the AS
> exchange. The KDC then looks in the global directory to find the name. 

[...]

> The user needs to know his own realm before making the AS request to get
> the initial TGT.

You keep saying this.  But you do say how the client is supposed to
determine her/his own realm.  Even if the user knows that her/his
principal is

   [email-masked]

I still need to map this realm to a KDC.  The primary purpose of using
the DNS to find the Realm and Kerberos Service info is to allow
clients to be implemented without hardwired config files that the end
user must carry around with them from host to host.  We want to enable
Kerberos Telnet to be as ubiquitous as SSH.  That means that Kinko's
(or the IETF terminal room) must be able to install Kerberos libraries
and Telnet clients that use them without knowing the list of all
possible REALM to KDC mappings.  

I will pay your proposal the attention it deserves when you explain
how I can use it to determine the default realm for an arbitrary
machine and the KDC that goes along with it without requiring some
magical local config file or other hand waving.

---

It would also be useful for you to explain in detail how the use of
DNS to determine the realm for a service provides anything more than a
denial of service attack.

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]