Re: Wishlist: credential file update/access collision avoidance?

> ccache_type 3 and higher are written in net byte order rather than
> host byte order.  ccache_type 2 and prior are quite rare, as far
> as I can tell ccache_type 3 was introduced before the first formal
> release of MIT Kerberos and I've only seen one vendor (Cybersafe)
> use ccache_type 2 in code that is not beta.

My experience that is does not work to copy ccaches across endian
boundaries might as well be from broken type 3 implementation(s).

> That said, they can limit the attack surface to
> a much smaller group of people and so addresses are not completely
> useless. 

That was how I thought.

> I think that the decision to promote addressless tickets
> in preference to the variety with addresses was largely because
> putting addresses in the tickets causes various problems in modern
> networks and so the assurance that you buy from them is often
> outweighed by the problem that you might experience.

Yes, supporting tickets with adresses for users that come from
computers behind NAT is unfeasible. 

> But, there is also another consideration.  If you are able to get
> a copy of my TGT and its session key then you are most likely
> reading my ccache which means that you are on my computer because
> ccaches are (should be) only stored in local file systems which
> are not exported for reading.  In this case, you do not _need_ to
> spoof my IP address, you've already got access to the ability to
> use my network stack in which case you can simply perform a TGS_REQ
> with my TGT and ask for an addressless one which you can take off
> to any other computer and use.

True, if evil boy can execute stuff on my computer. If he can only
copy files from it, different story.

Btw, if I have a forwarded ticket and then issue a "kinit --addr -R",
why do I as a result get success from kinit but tickets that do not
have adresses in them? (heimdal 1.3.3) I clearly wanted --addr on
the kinit command line and I did not get it. Is that a bug?

Harald.