[18985] in Kerberos_V5_Development
Multi-round trip extension
daemon@ATHENA.MIT.EDU (Nico Williams)
Mon Sep 1 17:49:30 2014
Date: Mon, 1 Sep 2014 16:49:22 -0500
From: Nico Williams <nico@cryptonector.com>
To: heimdal-discuss@sics.se, krbdev@mit.edu
Message-ID: <20140901214921.GB2955@localhost>
MIME-Version: 1.0
Content-Disposition: inline
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
It'd be nice if the AP / mech protocol could recover from various
failures by doing one more round-trip, such as:
- skew too great
- wrong kvno (why force users to kinit?! this is a huge pain-point for
users!)
- replay cache avoidance (server doesn't want it; challenge/response)
- replay cache false positive (if the server is using a probabilistic
rcache data structure)
Protocol-wise we just need an Authenticator flag by which the client/
initiator can tell the server that it is willing to engage in one
more round trip. The server/acceptor needs a way to indicate the
same in a KRB-ERROR (or through an extended AP-REP, maybe? when the
server can decrypt the Ticket).
Discovering HTTP/Negotiate apps that can't deal with more than one
round trip will. be. fun. We may have to exempt the HTTP service in
some cases.
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
