Re: KDC model and atomicity

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/11/2012 02:47 AM, Nico Williams wrote:
> On Sun, Jun 10, 2012 at 5:08 PM, Leif Johansson <[email protected]>
> wrote:
>> On 06/10/2012 10:25 PM, Greg Hudson wrote:
>>> I agree that N-strikes lockout, implemented through counters in
>>> the KDB, is not the final word on how one should respond to a 
>>> password-guessing attack, and we don't want to carve it in
>>> stone.
>>> 
>>> The simplest, and possibly best, thing to say about lockout in
>>> the information model is nothing.  Of course, that doesn't help
>>> us get to the point of interoperating on administrative
>>> operations related to lockout (policy-setting and
>>> administrative unlock)--but that can always be the subject of
>>> future revisions to the model (or schema, or admin protocol).
>> 
>> Well I think Nicos point was that you can't even implement the
>> attribute in question wo transactions across all KDCs in a
>> realm.
> 
> But Greg's is that our concern here should be about interop w.r.t. 
> administration.  I think that's clarifying.  I think we want to
> say that there should be a way to set a policy indicating what
> action to take when password guessing attacks are detected, and
> roughly how to detect them while not being prescriptive about
> implementation.  In other words, maybe we need a max number of
> failed password pre-auth attempts as a *policy*, and we should
> refrain from specifying any attributes regarding how the KDCs keep
> track of that number.  I'd be happy with that.

Could somebody propose text?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk/Vv8wACgkQ8Jx8FtbMZnd8fACfQu62qXPUio/sXYmQ8KPSDKbn
V+EAmwQjsBH/G0VQBmNjuxsUZMBgLUVN
=aVup
-----END PGP SIGNATURE-----
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg