Subject: Re: [Ietf-krb-wg] DHCPv6 transport service option

From: Leif Johansson <[email-masked]>
Date: Thu, 6 Aug 2009 13:19:55 +0200

>
> Leif pointed out that krb5starttls is run over TCP, so a type value for
> TLS is not really needed.  (I believe this was Leif's entire comment,
> correct me if I'm wrong.)  I didn't know how to respond.

That was the entire point.

>
> Having had a chance to think more about this, I see some value in having
> a number reserved for TLS: it allows clients to avoid having to spend
> one round-trip to find out the KDC does not support starttls.  That is a
> minor optimization, but since I also do not see any harm in having a
> value allocated, I think it makes sense to add it.
>
> If a TLS service type is present, the client saves one round-trip.  If
> the TLS service type is not present, and only the TCP type is present,
> the client cannot infer anything and could attempt to negotiate TLS.
>
> The high-level issue is of course whether the Service Type is useful at
> all.  I'm positive about it and would prefer to mirror the DNS SRV
> packet exactly and defer to RFC 4120 and RFC 2052 for the semantics.

My only observation is that the same reasoning applies to any case
of parameter negotiation and as long as you don't allow for negative
parameters to be published over an insecure medium you should
be fine, i.e "does-not-support-starttls" in DNS is bad since an attacker in
control over DNS could fool the client "away" from using a feature 
that would have added some additional measure of security.

	Cheers Leif

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg