Re: Miscellaneous CAMMAC issues
Greg Hudson <[email protected]>
| Newsgroups | gmane.ietf.krb-wg |
|---|---|
| Message-ID | <[email protected]> |
On 02/15/2012 01:10 PM, Jeffrey Hutzelman wrote: > You keep saying that, but it is not true. A service can print a ticket > for itself whenever it wants, not only when using S4U2Proxy. A "normal" > TGS request is authenticated by a TGT, but a request to modify a ticket > is authenticated only by the ticket to be modified, which means that any > data signed by either the ticket session key or the service's long-term > key cannot be trusted by the KDC. I hadn't considered renewal/validation of service tickets. (Which is rare, but probably not so rare that we can throw it away.) If the KDC needs to re-sign CAMMACs during renewal/validation, then it does need a way to verify that it originated them. Otherwise the target service could get the KDC to help it forge a trusted-svc-signature on arbitrary authdata elements. I'm not sure whether the current drafts require the CAMMAC to be re-signed on renewal/validation. Certainly, if the svc-signature uses the session key and the trusted-svc-signature encompasses the svc-signature (as Sam suggested) then re-signing would be necessary. _______________________________________________ ietf-krb-wg mailing list [email protected] https://lists.anl.gov/mailman/listinfo/ietf-krb-wg