Subject: Re: comments on kerberos-revisions-05.txt

From: Sam Hartman <[email-masked]>
Date: 03 Apr 2000 07:55:23 -0400

>>>>> "Booker" == Booker Bense <[email-masked]> writes:

    Booker> - This halfway position (i.e. realm names are
    Booker> case-sensitive, but you can't use lower case ) makes very
    Booker> little sense to me.

It's unfortunately how many of the non-DCE implementations work
though.  There is a significant deployed base of realms with
upper-caseprincipal names.  You can't make it case insensitive because
that would break realm-based salting of keys among other things.  

--Sam
-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: "RL 'Bob' Morgan" <[email-masked]>
Date: Mon, 3 Apr 2000 15:48:07 -0700 (PDT)

> that would break realm-based salting of keys among other things.

Sorry, this isn't good enough.  Let me reach over and turn on my recording
(OK, recollection) of John Klensin's famous "pain" speech, which I happen
to have handy because he just gave it again in Adelaide at the
Internationalized DNS BoF:

  Resolution of incompatibility is a matter of allocating pain.  You can't
  just say "it has to work this way because otherwise it won't work for
  me", since the basic problem is that everyone is saying that, so the
  problem is over-constrained.  *Someone* will have to feel the pain of
  change or of non-interoperability, the question is who.

I have a site with 100K user principals and thousands of host principals
using an all-lower-case realm.  It works fine, for some definition of
fine.  Changing realm names will be painful.  Having to change our realm
name, which is entirely compliant with RFC 1510, based on an unjustified
one-line change in a not-yet-issed revisions RFC that declares it illegal
in a non-backwards-compatible fashion, makes me want to know very
precisely whose pain is being avoided, and how much, and why I have to
suffer and they don't.

It seems clear to me that the desired end state is having realm names be
case-preserving in use and case-insensitive in matching, which is to say,
*exactly* like host names in DNS.  I think the dns-locate functionality
serves to further justify this approach.  Can someone explain in detail
(or point to existing explanations) why requiring all-upper-case realms is
a better end state?

Thanks,

 - RL "Bob"

---

From: Clifford Neuman <[email-masked]>
Date: Mon, 3 Apr 2000 16:20:42 -0700 (PDT)

Using upper case DNS realm names is not a change, but instead the way
things have been all along.  Early on it was decided that names in
Kerberos needed to be case sensitive because we did not have control
over the environments within which Kerberos would be used.  

If names were not case sensitive, then use of Kerberos in an
environment that had case sensitive names would be difficult.
However, case sensitive names in Kerberos were easily used in
environments where names were not case sensitive, simply by adopting
the convention on which case would be used in the Kerberos encoding.

Choosing case preservation, but insensitive matching was not an
acceptable solution, because in such environments where case
sensitivity mattered, the consequence for the security of the system
could be significant.

As to whether the convention chosen was for DNS realm names to be
upper case or lower case, that was decided a LONG time ago.  The chose
was upper case - I do not recall the reason offhand - but
unfortunately it wasn't a significant reason and it might have even
been arbitrary.  

Now, their might have been a failure to communicate this choice, but
it was the choice and it is not an issue that can be revisited at this
time.  Though it doesn't constitute communications of the convention,
all DNS based realm name examples in RFC1510 were upper case.  That
would strongly argue against an imposition of lower case as the
convention.   

Clifford Neuman

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Tue, 4 Apr 2000 21:40:17 -0400

> that would break realm-based salting of keys among other things.

Since the very, very, very early days, Kerberos has always used
upper-case realm names as the convention.  This was the case for both
Kerberos V4 and V5.  OSF DCE violated this convention for apparently no
good reason, and instead adopted the opposite convention --- and by the
time those of us at MIT found out about it, it was too late to get them
to change it.  

(Unfortunately, vendors have this bad track record of taking Open Source
Software, making incompatible changes, and not telling the original
authors about it until it's way too late, which usually causes a massive
support headache for the original authors.  This is one of the reasons
why some GPL advocates dislike the BSD or X-consortium style copyrights.
MIT explicitly chose the an X-consortium because we wanted vendors to
adopt our code.  This means we have to live with the consequences of
some bad decisions by a number of vendors, not just OSF.  Given 20/20
hindsight, if I had to do it all over ago, I'd probably argue in favor
of some copyright license which didn't allow the implementation of
protocol changes or enhancements without the express approval of the MIT
Kerberos team.  But, I digress.  It probably wouldn't have helped the
OSF screwup in any case.)

Fortunately or unfortunately, only a few institutions chose to hook
themselves to the falling star which was OSF DCE.  There are a number of
reasons why OSF DCE was a failure, but it basically boiled down to very
few people wanting to adopt the super-heavyweight infrastructure which
was OSF DCE.  So I'd argue there are relatively few sites which have the
lower-case realm name problem, especially in comparison with all of the
other sites which obeyed the original Kerberos convention.  This
includes everyone using Transarc AFS, and the Cygnus, Cybersafe, and
other commercial Kerberos products which didn't stray as far as from the
original MIT implementation, and of course, not to mention, Windows
2000, which at least got right the upper-case convention for realm
names.

No, I think matching needs to remain case-sensitive; otherwise you run
into random access control list problems.  It's better to be able to
encourage people to use upper-case realm names, and it would be possible
to add support to a KDC to help make the transition to upper-case realm
names less painful.

However, given that the Kerberos DNS I-D does support mixed-case realm
names (with a someone awkward escape mechanism, but since it only hits
mixed-case realms, I don't mind), I don't think we necessary need to
chance anything from the current treatment of realm names, which is:

	* case sensitive
	* all upper-case convention for realm names strongly encouraged.

						- Ted

---

From: Russ Allbery <[email-masked]>
Date: 04 Apr 2000 19:23:25 -0700

> time those of us at MIT found out about it, it was too late to get them

We had some discussion of the issue here at Stanford when we had a good
opportunity to pick our realm name, and decided that all lowercase was
preferrable from a user education standpoint.  A Kerberos principal looks
very much like an e-mail address, and given that our K5 realm name will be
the same as our main mailing domain (stanford.edu), we felt it would be a
lot easier to explain [email-masked] to users who don't really
understand all of this than [email-masked].

I admit to a strong personal bias in favor of all-lowercase domain names
everywhere.  The MIT uppercase convention has always bugged me, and so has
Stanford's current mixed case convention.  :)  Uppercase characters are
harder to type, less frequently used, and pretty much everything else
except LISTSERV (*sigh*) uses lowercase for just about everything.  The
all-uppercase realm name convention seems an odd throwback to me.

I don't think that any of the above is a strong argument, in the sense
that I think technical arguments and backwards compatibility arguments do
trump these sorts of issues.  But I wanted to throw out an example of
reasons why people may decide to use lowercase realm names even without
issues related to DCE.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>