Re: Last Call: 'Kerberized Internet Negotiation of Keys (KINK)' to Proposed Standard (fwd)

--==========B16693EF26EE7B7E5C23==========
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

> 4.2.3.  KINK_KRB_ERROR Payload [...]
>
>   KINK implementations MUST make use of a KINK Cksum field when
>   returning KINK_KRB_ERROR and the appropriate service key is
>   available.  In particular, clock skew errors MUST be integrity
>   protected.

The kerberos API, such as it is, does not guarantee that the application=20
will have access to the ticket session key if KRB5KRB_AP_ERR_SKEW is=20
returned from krb5_rd_req. neither mit krb5 nor heimdal return the=20
decrypted ticket if krb5_rd_req fails. (current releases of heimdal do not=20
check for clock skew in krb5_rd_req! This will be corrected in a future=20
release) It does not appear that either implementation updates the keyblock =

stored in the auth_context until after all authenticator checks are=20
complete, so that copy of the key is not available to the application=20
either.

While implementation concerns like this are not usually critical, in this=20
case, I think they should be considered, since it is far more likely that=20
this part of the spec will be ignored than the kerberos implementations be=20
extended to make it possible for kink implementations to conform to it.

I do not recommend just removing the integrity protection requirement from=20
skew errors. if integrity for skew errors was not required, an attacker=20
might be able to coerce an initiator into producing an AP_REQ that is=20
invalid now, but could be successfully replayed at a later time.

--==========B16693EF26EE7B7E5C23==========
Content-Type: application/pkcs7-signature
Content-Transfer-Encoding: base64

MIIL1wYJKoZIhvcNAQcCoIILyDCCC8QCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3
DQEHAaCCCVswggLjMIICTKADAgECAgMO/8kwDQYJKoZIhvcNAQEEBQAwYjELMAkG
A1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4x
LDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4X
DTA1MDYyMzE3MzEzMFoXDTA2MDYyMzE3MzEzMFowRTEfMB0GA1UEAxMWVGhhd3Rl
IEZyZWVtYWlsIE1lbWJlcjEiMCAGCSqGSIb3DQEJARYTY2cydkBhbmRyZXcuY211
LmVkdTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALujtch96NHbplBs
5DnSTn03EsnbYsLng/wM+wbfyS6ml6CCGYl7HY+sIBm4DNygpyQz0mvtvy9kKz7V
M2GTYdH5QLOgxxPxzV3fItv4jF9LKr9tIiT+v9K7XQ2Xl4kDyJi1g19UsKU4wf+s
uFdennXZ0pkWTpUld9JRZiLSYQDs/Hi62OekBfIX+H96AskyMBhZj5OVA+CYtnCj
fzVYO4a/RoAmemQhlv+whF0Qa3QFrLZtrDXKeYX95KU78q6+cJqtiAri4H3k8NpD
SeWavUxFyH/PFhCYPVdfVDiwaTwfEI5lBF0vTTTL8kSnJSmRBRWw9RkYHNZ8hxBC
Oo9m1oMCAwEAAaNAMD4wDgYDVR0PAQH/BAQDAgXgMB4GA1UdEQQXMBWBE2NnMnZA
YW5kcmV3LmNtdS5lZHUwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQQFAAOBgQCR
W9k/ckGNAJQ+DeUey0Hed2nlQb4goaakkHviC70vAVt0N34yrk3uxBf5Kch2olqM
SMCR+9+b1iXn0NU9n7QppayQ7SsYci3m8eMlaBk1pK91LrHGQL+ZEqOPqwhRmb0a
lQFAAoJpJdotCBzy0X1GP83i+2DUdT6ydPlmtsm8djCCAz8wggKooAMCAQICAQ0w
DQYJKoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJu
IENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1
bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24x
JDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3
DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcwMDAw
MDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3
dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29u
YWwgRnJlZW1haWwgSXNzdWluZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
gYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me7L3N9VvyGna9fww6YfK/Uc4B1OVQ
CjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQqE88r1fOCdz0Dviv+uxg+
B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCBkTAS
BgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwu
dGhhd3RlLmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQE
AwIBBjApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgw
DQYJKoZIhvcNAQEFBQADgYEASIzRUIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4
+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6EsZkbAMUaC4J0niVQlGLH2ydxVyWN
3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341YheILcIRk13iSx0x1G/11f
ZU8wggMtMIIClqADAgECAgEAMA0GCSqGSIb3DQEBBAUAMIHRMQswCQYDVQQGEwJa
QTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAY
BgNVBAoTEVRoYXd0ZSBDb25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9u
IFNlcnZpY2VzIERpdmlzaW9uMSQwIgYDVQQDExtUaGF3dGUgUGVyc29uYWwgRnJl
ZW1haWwgQ0ExKzApBgkqhkiG9w0BCQEWHHBlcnNvbmFsLWZyZWVtYWlsQHRoYXd0
ZS5jb20wHhcNOTYwMTAxMDAwMDAwWhcNMjAxMjMxMjM1OTU5WjCB0TELMAkGA1UE
BhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3du
MRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNh
dGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFs
IEZyZWVtYWlsIENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0
aGF3dGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDUadfUsJRkW3Hp
R9gMUbbqcpGwhF59LQ2PexLfhSV1KHQ6QixjJ5+Ve0vvfhmHHYbqo925zpZkGsIU
bkSsfOaP6E0PcR9AOKYAo4d49vmUhl6t6sBeduvZFKNdbnp8DKVLVX8GGSl/npom
1Wq7OCQIapjHsdqjmJH9edvlWsQcuQIDAQABoxMwETAPBgNVHRMBAf8EBTADAQH/
MA0GCSqGSIb3DQEBBAUAA4GBAMfskn5O+PWWpWdiKqTwTRFg0G+NYFhhrCa7UjVc
CM8w+6hKloofYkIjjBcP9LpknBesRynfnZhe0mxgcVyirNx54+duAEcftQ0o6AKd
5Jr9E/Sm2Xyx+NxfIyYJkYBz0BQb3kOpgyXy5pwvFcr+pquKB3WLDN1RhGvk+NHO
d6KBMYICRDCCAkACAQEwaTBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3Rl
IENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFs
IEZyZWVtYWlsIElzc3VpbmcgQ0ECAw7/yTAJBgUrDgMCGgUAoIGxMBgGCSqGSIb3
DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA1MTEyOTIzMDExOVow
IwYJKoZIhvcNAQkEMRYEFM3EL9x7cFqDCNq8yagwQrLh4nSjMFIGCSqGSIb3DQEJ
DzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFA
MAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAAUbV6cG
7o3R5JszXCiaIcFih02CFy318vrD5J3Wc3L5SPMo5qVXGxSzIjFHvEjCy30n76AM
NDmCDlNFprBg8jrGOO5JN3m5MqYe9D5P0U8ZbN3sRJR+EAphH4V65OdbHcxr5L5L
RRXnu7Z5XuznJNZU9f9OAvWZMU4kuIZcCK3dzG339kWDVyrzCoACiAVY5nwAnFZ5
jlKYFMJLr/uWI1vPmmBwFWYyehLPa/cLn0CKP8jLaC/fu3VL59a5ZEW1Fi6NOkLb
duYjxcGOhApx9gdokV9sug0+EtqdUZJVGB1SU4E5N4XG2wFtFQr3NkHwG/ixRBj3
J8eTuj44aFvK2fg=

--==========B16693EF26EE7B7E5C23==========--