Internet DRAFT - draft-yu-kitten-kerberos-kdc-does-aliases
draft-yu-kitten-kerberos-kdc-does-aliases
Internet Engineering Task Force T. Yu
Internet-Draft MIT Kerberos Consortium
Updates: 4120 (if approved) Feb 2013
Intended status: Standards Track
Expires: August 5, 2013
Kerberos Ticket flag indicating KDC support for resolving hostname
aliases
draft-yu-kitten-kerberos-kdc-does-aliases-00
Abstract
This document specifies a Kerberos Ticket flag that indicates that
the Key Distribution Center (KDC) can resolve hostname aliases in
service principal names. This document updates RFC 4120.
Status of this Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on August 5, 2013.
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Yu Expires August 5, 2013 [Page 1]
Internet-Draft KDC-resolves-aliases flag Feb 2013
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Requirements Language . . . . . . . . . . . . . . . . . . . . . 3
3. Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . 3
4. KDC Behavior . . . . . . . . . . . . . . . . . . . . . . . . . 3
5. Client Behavior . . . . . . . . . . . . . . . . . . . . . . . . 3
6. Assigned numbers . . . . . . . . . . . . . . . . . . . . . . . 4
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 4
8. Security Considerations . . . . . . . . . . . . . . . . . . . . 4
9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 4
10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 4
10.1. Normative References . . . . . . . . . . . . . . . . . . . 4
10.2. Informative References . . . . . . . . . . . . . . . . . . 5
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 5
Yu Expires August 5, 2013 [Page 2]
Internet-Draft KDC-resolves-aliases flag Feb 2013
1. Introduction
This document specifies a new Kerberos Ticket flag that indicates
that the Key Distribution Center (KDC) is capable of resolving
hostname aliases. A Kerberos client can interpret the presence of
this Ticket flag as a recommendation to avoid using potentially
insecure DNS lookups to canonicalize hostnames when constructing
Kerberos principal names.
2. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [RFC2119].
3. Motivation
When attempting to authenticate to a Kerberos application service,
existing Kerberos client implementations typically perform hostname
canonicalization when constructing the Kerberos service principal.
In practice, these clients canonicalize using insecure DNS, contrary
to the recommendations in RFC 4120 [RFC4120]. Implementations are
not consistent about whether they use forward resolution (looking up
an address record for the user-provided hostname and returning the
accompanying canonical hostname) or reverse resolution (taking the IP
address from a forward resolution and returning the reverse pointer
(PTR) record) to canonicalize hostname components of Kerberos service
principal names.
4. KDC Behavior
If a KDC has knowledge of all hostname aliases for host-based service
principal names in its realm, it SHOULD set the kdc-resolves-aliases
(number TBD) flag in the Ticket and EncKDCRepPart for all tickets it
issues.
5. Client Behavior
If a client receives an EncKDCRepPart that has the flag kdc-resolves-
aliases set, it SHOULD NOT attempt to canonicalize hostnames in
service principal names for the realm whose KDC set that flag.
Instead, the client SHOULD use the unchanged user-provided hostname
when constructing the service principal name. The following
behaviors in RFC 4120 [RFC4120] are still permitted: clients MAY
Yu Expires August 5, 2013 [Page 3]
Internet-Draft KDC-resolves-aliases flag Feb 2013
append a statically configured domain name to unqualified hostname,
and clients SHOULD fold the hostname to lowercase.
6. Assigned numbers
TBD
7. IANA Considerations
TBD.
8. Security Considerations
The new ticket flag described in this document allows Kerberos realm
administrators to communicate a recommendation to clients that they
not attempt any hostname canonicalization when constructing service
principal names. This avoids the use of insecure DNS to resolve
hostnames, which can allow principal name substitution attacks in
some environments.
9. Acknowledgements
Thanks to Sam Hartman, Love Hornquist Astrand, and many others who
suggested this idea and contributed to its evolution.
10. References
10.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4120] Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The
Kerberos Network Authentication Service (V5)", RFC 4120,
July 2005.
[X.680] ISO, "Information technology -- Abstract Syntax Notation
One (ASN.1): Specification of basic notation -- ITU-T
Recommendation X.680 (ISO/IEC International Standard 8824-
1:2008)", 2008.
[X.690] ISO, "Information technology -- ASN.1 encoding rules:
Specification of Basic Encoding Rules (BER), Canonical
Yu Expires August 5, 2013 [Page 4]
Internet-Draft KDC-resolves-aliases flag Feb 2013
Encoding Rules (CER) and Distinguished Encoding Rules
(DER) -- ITU-T Recommendation X.690 (ISO/IEC International
Standard 8825-1:2008)", 1997.
10.2. Informative References
[RFC1510] Kohl, J. and B. Neuman, "The Kerberos Network
Authentication Service (V5)", RFC 1510, September 1993.
Author's Address
Tom Yu
MIT Kerberos Consortium
77 Massachusetts Ave
Cambridge, Massachusetts
USA
Email: tlyu@mit.edu
Yu Expires August 5, 2013 [Page 5]
