https://k5wiki.kerberos.org/wiki?action=history&feed=atom&title=Projects%2FAnonymous_pkinit 2026-04-08T16:57:49Z Revision history for this page on the wiki MediaWiki 1.27.4 https://k5wiki.kerberos.org/wiki?title=Projects/Anonymous_pkinit&diff=5004&oldid=prev 2012-12-12T20:43:53Z

<p></p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;' lang='en'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 20:43, 12 December 2012</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>{{project-rel|1.8}}</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>{{project-rel|1.8}}</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The ''Anonymous Pkinit'' project is an implementation of anonymous pkinit from {{<del class="diffchange diffchange-inline">idref</del>|<del class="diffchange diffchange-inline">draft-ietf-krb-wg-anon-10</del>}}. This project allows users to obtain Kerberos tickets even if they have no principal registered in a realm. Use cases include hiding identity of a user for privacy, using [[Projects/FAST|FAST]] without registering a host, or automated registration of hosts.</div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The ''Anonymous Pkinit'' project is an implementation of anonymous pkinit from {{<ins class="diffchange diffchange-inline">rfcref</ins>|<ins class="diffchange diffchange-inline">6112</ins>}}. This project allows users to obtain Kerberos tickets even if they have no principal registered in a realm. Use cases include hiding identity of a user for privacy, using [[Projects/FAST|FAST]] without registering a host, or automated registration of hosts.</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>==Functional Requirements==</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>==Functional Requirements==</div></td> </tr> </table>

Ghudson https://k5wiki.kerberos.org/wiki?title=Projects/Anonymous_pkinit&diff=3174&oldid=prev 2010-02-16T04:20:09Z

<p></p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;' lang='en'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 04:20, 16 February 2010</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 102:</td> <td colspan="2" class="diff-lineno">Line 102:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>===Approvals===</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>===Approvals===</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div># [[User:TomYu|TomYu]] 04:20, 16 February 2010 (UTC)</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>===Discussion===</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>===Discussion===</div></td> </tr> </table>

TomYu https://k5wiki.kerberos.org/wiki?title=Projects/Anonymous_pkinit&diff=3173&oldid=prev 2010-02-16T04:19:44Z

<p></p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;' lang='en'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 04:19, 16 February 2010</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>{{project-<del class="diffchange diffchange-inline">review</del>|<del class="diffchange diffchange-inline">01/11/2010</del>}}</div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>{{project-<ins class="diffchange diffchange-inline">rel</ins>|<ins class="diffchange diffchange-inline">1.8</ins>}}</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>The ''Anonymous Pkinit'' project is an implementation of anonymous pkinit from {{idref|draft-ietf-krb-wg-anon-10}}. This project allows users to obtain Kerberos tickets even if they have no principal registered in a realm. Use cases include hiding identity of a user for privacy, using [[Projects/FAST|FAST]] without registering a host, or automated registration of hosts.</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>The ''Anonymous Pkinit'' project is an implementation of anonymous pkinit from {{idref|draft-ietf-krb-wg-anon-10}}. This project allows users to obtain Kerberos tickets even if they have no principal registered in a realm. Use cases include hiding identity of a user for privacy, using [[Projects/FAST|FAST]] without registering a host, or automated registration of hosts.</div></td> </tr> <tr> <td colspan="2" class="diff-lineno">Line 92:</td> <td colspan="2" class="diff-lineno">Line 92:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Add command line flag for requesting anonymous credentials</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Add command line flag for requesting anonymous credentials</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* ACL handling requires no changes</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* ACL handling requires no changes</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>==Review==</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>This section documents the review of the project according to [[Project policy]].</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>It is divided into multiple sections. First, approvals should be listed. To list an approval type</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>:&lt;nowiki&gt;#~~~~&lt;/nowiki&gt;</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>(hash mark followed by four tilde characters) on its own line.</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The next section is for summarizing discussion, which should take place on krbdev@mit.edu. Provide links to the archive at http://mailman.mit.edu/pipermail/krbdev/ if appropriate. Blocking objections can be noted with &lt;nowiki&gt;{{project-block}}&lt;/nowiki&gt;.</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>===Approvals===</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>===Discussion===</div></td> </tr> </table>

TomYu https://k5wiki.kerberos.org/wiki?title=Projects/Anonymous_pkinit&diff=3090&oldid=prev 2010-01-04T20:40:19Z

<p>updates based on what was done</p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;' lang='en'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 20:40, 4 January 2010</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>{{project-<del class="diffchange diffchange-inline">early</del>}}</div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>{{project-<ins class="diffchange diffchange-inline">review|01/11/2010</ins>}}</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>The ''Anonymous Pkinit'' project is an implementation of anonymous pkinit from {{idref|draft-ietf-krb-wg-anon-10}}. This project allows users to obtain Kerberos tickets even if they have no principal registered in a realm. Use cases include hiding identity of a user for privacy, using [[Projects/FAST|FAST]] without registering a host, or automated registration of hosts.</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>The ''Anonymous Pkinit'' project is an implementation of anonymous pkinit from {{idref|draft-ietf-krb-wg-anon-10}}. This project allows users to obtain Kerberos tickets even if they have no principal registered in a realm. Use cases include hiding identity of a user for privacy, using [[Projects/FAST|FAST]] without registering a host, or automated registration of hosts.</div></td> </tr> <tr> <td colspan="2" class="diff-lineno">Line 31:</td> <td colspan="2" class="diff-lineno">Line 31:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>is accomplished by including a KDC contribution key and confirming</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>is accomplished by including a KDC contribution key and confirming</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>that the TGS session key is the combination of the KDC contribution</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>that the TGS session key is the combination of the KDC contribution</div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>key and the reply key. <del class="diffchange diffchange-inline">Discussion</del> <del class="diffchange diffchange-inline">in</del> <del class="diffchange diffchange-inline">the</del> <del class="diffchange diffchange-inline">working</del> <del class="diffchange diffchange-inline">group may simplify</del></div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>key and the reply key. <ins class="diffchange diffchange-inline">This</ins> <ins class="diffchange diffchange-inline">mechanism</ins> <ins class="diffchange diffchange-inline">has</ins> <ins class="diffchange diffchange-inline">been</ins> <ins class="diffchange diffchange-inline">implemented.</ins></div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>this procedure somewhat.</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Regardless, the KDC does not currently have a mechanism for a pre-authentication plugin to influence the session key that is chosen.</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>There are two approaches:</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>* Add support for this behavior to the main body of the KDC </div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>* Add support for a more general mechanism for plugins to frob the session key </div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>While the first approach does involve the main body of the KDC learning a bit about anonymous pkinit, it is probably desirable because it will be less complex and because it will avoid other plugins affecting critical security parameters.</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== KDC Changes ==</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== KDC Changes ==</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del class="diffchange diffchange-inline">*</del> <del class="diffchange diffchange-inline">Implement authorization</del> data minimization <del class="diffchange diffchange-inline">for anonymous requests</del></div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">===</ins> <ins class="diffchange diffchange-inline">Authorization</ins> data minimization <ins class="diffchange diffchange-inline">===</ins></div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del class="diffchange diffchange-inline">* Add support for anonymous principal </del></div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div></div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del class="diffchange diffchange-inline">*</del> <del class="diffchange diffchange-inline">Add</del> <del class="diffchange diffchange-inline">config</del> <del class="diffchange diffchange-inline">option</del> <del class="diffchange diffchange-inline">to</del> <del class="diffchange diffchange-inline">enable</del> <del class="diffchange diffchange-inline">anonymous</del> <del class="diffchange diffchange-inline">for</del> <del class="diffchange diffchange-inline">a</del> <del class="diffchange diffchange-inline">realm</del></div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">A</ins> <ins class="diffchange diffchange-inline">new</ins> <ins class="diffchange diffchange-inline">flag</ins> <ins class="diffchange diffchange-inline">on</ins> <ins class="diffchange diffchange-inline">authdata</ins> <ins class="diffchange diffchange-inline">plugins is added to</ins> <ins class="diffchange diffchange-inline">indicate</ins> <ins class="diffchange diffchange-inline">that</ins> <ins class="diffchange diffchange-inline">the</ins> <ins class="diffchange diffchange-inline">plugin</ins></div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del class="diffchange diffchange-inline">*</del> <del class="diffchange diffchange-inline">Handle</del> <del class="diffchange diffchange-inline">session</del> <del class="diffchange diffchange-inline">key</del> <del class="diffchange diffchange-inline">derivation</del></div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">supports</ins> <ins class="diffchange diffchange-inline">anonymous</ins> <ins class="diffchange diffchange-inline">processing.</ins> <ins class="diffchange diffchange-inline">This flag is only set on the plugin</ins></div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>that copies TGT authorization data and the one that copies request</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>authorization data. Other plugins are skipped in anonymous mode.</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>=== Session keys ===</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The KDC chooses the session key before pre-authentication plugins are</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>given a chance to run. A pre-authentication plugin can change the</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>session key although if the session key has already been used this may</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>cause trouble. The only case where a pre-authentication plugin is</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>likely to use the session key is when generating authorization data to</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>be included in an issued ticket. If a PAC or AD-KDC-ISSUED element is</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>generated then it is likely that the session key will be used.</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>However anonymous processing trims out authorization data so this is</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>not an issue for anonymous. Also, the preauth framework on the KDC</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>side runs plugins that may replace the reply key before other plugins</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>so pkinit will always be the first preauth successful plugin when it</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>succeeds.</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The pkinit plugin generates a PA_PKINIT_KX padata item so that the client can confirm both parties contributed to the session key.</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>=== Enabling anonymous ===</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>If the &lt;tt&gt;WELLKNOWN/ANONYMOUS@REALM&lt;/tt&gt; principal exists then anonymous authentication is supported. No special considerations are made to prohibit changing the password of this principal. As a result, it may be possible for an attacker to change the password of this principal and perform anonymous authentication without actually using pkinit.</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== Pkinit Changes ==</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== Pkinit Changes ==</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Detect when anonymous is being used in the client and do not require key or sign the request</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Detect when anonymous is being used in the client and do not require key or sign the request</div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>* Verify session key form</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* KDC side: if anonymous tickets are requested don't require signed data to be signed</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* KDC side: if anonymous tickets are requested don't require signed data to be signed</div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>* Give KDC information it needs to construct session key</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== Library Changes ==</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== Library Changes ==</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Extend transited realm checking to deal with anonymous principals</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Extend transited realm checking to deal with anonymous principals</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Add GIC support for obtaining anonymous principals if the anonymous principal is the client</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Add GIC support for obtaining anonymous principals if the anonymous principal is the client</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>A new API, krb5_get_init_creds_opt_set_anonymous is added to set the</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>anonymous option. If this is turned on, then principals of the form</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>&lt;tt&gt;@&lt;i&gt;REALM&lt;/i&gt;&lt;/tt&gt; are mapped to the wellknown principal in a</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>realm. In addition, &lt;tt&gt;WELLKNOWN/ANONYMOUS@&lt;i&gt;REALM&lt;/i&gt;&lt;/tt&gt; is</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>always treated as an anonymous authentication.</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The canonicalization logic is expanded to permit any realm to be mapped to the anonymous realm when fully anonymous authentication is in use.</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-lineno">Line 68:</td> <td colspan="2" class="diff-lineno">Line 69:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Add command line flag for requesting anonymous credentials</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Add command line flag for requesting anonymous credentials</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* ACL handling requires no changes</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* ACL handling requires no changes</div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>== Still Todo ==</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>* Handle session key derivation</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>* Handle transited policy checking</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>* Kadmin deals poorly with the realm changing from what is requested</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>* Kadmin command line flag</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> </table>

SamHartman https://k5wiki.kerberos.org/wiki?title=Projects/Anonymous_pkinit&diff=3081&oldid=prev 2009-12-21T19:51:47Z

<p>update progress</p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;' lang='en'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 19:51, 21 December 2009</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 57:</td> <td colspan="2" class="diff-lineno">Line 57:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Extend transited realm checking to deal with anonymous principals</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Extend transited realm checking to deal with anonymous principals</div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>* Add GIC support for obtaining anonymous principals</div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>* Add GIC support for obtaining anonymous principals<ins class="diffchange diffchange-inline"> if the anonymous principal is the client</ins></div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del class="diffchange diffchange-inline">* Add convenience API for obtaining anonymous principals</del></div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div></div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== GSS-API Changes ==</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== GSS-API Changes ==</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Display the anonymous principal name as GSS_NT_ANONYMOUS</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Display the anonymous principal name as GSS_NT_ANONYMOUS</div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>* Add support for obtaining anonymous credentials and anonymous context establishment</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>* In this version GSS-API will be able to use existing anonymous credentials but will not be able to obtain credentials on its own. The main problem with obtaining credentials is selection of a realm to contact.</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== Kadmin Changes ==</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>== Kadmin Changes ==</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Add command line flag for requesting anonymous credentials</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>* Add command line flag for requesting anonymous credentials</div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>*<del class="diffchange diffchange-inline"> confirm</del> ACL handling <del class="diffchange diffchange-inline">can work</del> <del class="diffchange diffchange-inline">with</del> <del class="diffchange diffchange-inline">anonymous</del></div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>* ACL handling <ins class="diffchange diffchange-inline">requires</ins> <ins class="diffchange diffchange-inline">no</ins> <ins class="diffchange diffchange-inline">changes</ins></div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>== Still Todo ==</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>* Handle session key derivation</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>* Handle transited policy checking</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>* Kadmin deals poorly with the realm changing from what is requested</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>* Kadmin command line flag</div></td> </tr> </table>

SamHartman https://k5wiki.kerberos.org/wiki?title=Projects/Anonymous_pkinit&diff=2887&oldid=prev 2009-11-02T23:32:53Z

<p>New page: {{project-early}} The &#039;&#039;Anonymous Pkinit&#039;&#039; project is an implementation of anonymous pkinit from {{idref|draft-ietf-krb-wg-anon-10}}. This project allows users to obtain Kerberos tickets...</p> <p><b>New page</b></p><div>{{project-early}}<br /> <br /> The ''Anonymous Pkinit'' project is an implementation of anonymous pkinit from {{idref|draft-ietf-krb-wg-anon-10}}. This project allows users to obtain Kerberos tickets even if they have no principal registered in a realm. Use cases include hiding identity of a user for privacy, using [[Projects/FAST|FAST]] without registering a host, or automated registration of hosts.<br /> <br /> ==Functional Requirements==<br /> <br /> anonymous tickets are tickets with a special well-known realm and principal name for the client principal. This principal will never appear in the service principal.<br /> The primary use case that motivates this project now is support for using anonymous tickets in host registration. That means that kadmin needs to support anonymous tickets and that kadmind needs to be able to ACL operations to anonymous principals.<br /> <br /> The anonymous draft makes it optional whether KDCs are required to<br /> have certificates when anonymous pkinit is used. However if KDCs do<br /> not have certificates, authentication of KDCs becomes complicated.<br /> FAST permits an anonymous ticket corresponding to an unauthenticated<br /> KDC to be used in some circumstances. However authentication state<br /> needs to be maintained because some fast factors should not be used<br /> with an unauthenticated KDC. Most other uses of Kerberos are not<br /> appropriate with an anonymous KDC. So, implementing unauthenticated<br /> KDCs introduces significant code and policy complexity. It will not<br /> be included in this project but may be added in the future. Instead, for this project, we will implement support for anonymous clients using the traditional pkinit certificate verification rules.<br /> <br /> The following is required:<br /> * Administrative configuration to permit a realm to issue anonymous tickets<br /> * API for requesting anonymous tickets<br /> * Command line switches for kadmin and kinit <br /> * GSS-API changes to support anonymous name type<br /> <br /> == Confirming Client and KDC Contribution ==<br /> <br /> The anonymous draft requires that the client confirm that both the<br /> client and KDC contributed to the TGS session key. In draft 10 this<br /> is accomplished by including a KDC contribution key and confirming<br /> that the TGS session key is the combination of the KDC contribution<br /> key and the reply key. Discussion in the working group may simplify<br /> this procedure somewhat.<br /> <br /> Regardless, the KDC does not currently have a mechanism for a pre-authentication plugin to influence the session key that is chosen.<br /> There are two approaches:<br /> * Add support for this behavior to the main body of the KDC <br /> * Add support for a more general mechanism for plugins to frob the session key <br /> <br /> While the first approach does involve the main body of the KDC learning a bit about anonymous pkinit, it is probably desirable because it will be less complex and because it will avoid other plugins affecting critical security parameters.<br /> <br /> == KDC Changes ==<br /> <br /> * Implement authorization data minimization for anonymous requests<br /> * Add support for anonymous principal <br /> * Add config option to enable anonymous for a realm<br /> * Handle session key derivation<br /> <br /> == Pkinit Changes ==<br /> <br /> * Detect when anonymous is being used in the client and do not require key or sign the request<br /> * Verify session key form<br /> * KDC side: if anonymous tickets are requested don't require signed data to be signed<br /> * Give KDC information it needs to construct session key<br /> == Library Changes ==<br /> <br /> * Extend transited realm checking to deal with anonymous principals<br /> * Add GIC support for obtaining anonymous principals<br /> * Add convenience API for obtaining anonymous principals<br /> <br /> == GSS-API Changes ==<br /> <br /> * Display the anonymous principal name as GSS_NT_ANONYMOUS<br /> * Add support for obtaining anonymous credentials and anonymous context establishment<br /> <br /> == Kadmin Changes ==<br /> <br /> * Add command line flag for requesting anonymous credentials<br /> * confirm ACL handling can work with anonymous</div>

SamHartman