Re: KDC model and atomicity

On Sun, Jun 10, 2012 at 5:08 PM, Leif Johansson <[email protected]> wrote:
> On 06/10/2012 10:25 PM, Greg Hudson wrote:
>> I agree that N-strikes lockout, implemented through counters in the
>> KDB, is not the final word on how one should respond to a
>> password-guessing attack, and we don't want to carve it in stone.
>>
>> The simplest, and possibly best, thing to say about lockout in the
>> information model is nothing.  Of course, that doesn't help us get
>> to the point of interoperating on administrative operations related
>> to lockout (policy-setting and administrative unlock)--but that can
>> always be the subject of future revisions to the model (or schema,
>> or admin protocol).
>
> Well I think Nicos point was that you can't even implement the attribute
> in question wo transactions across all KDCs in a realm.

But Greg's is that our concern here should be about interop w.r.t.
administration.  I think that's clarifying.  I think we want to say
that there should be a way to set a policy indicating what action to
take when password guessing attacks are detected, and roughly how to
detect them while not being prescriptive about implementation.  In
other words, maybe we need a max number of failed password pre-auth
attempts as a *policy*, and we should refrain from specifying any
attributes regarding how the KDCs keep track of that number.  I'd be
happy with that.

Nico
--
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg