Subject: Re: comments on kerberos-revisions-05.txt

From: [email-masked]
Date: Tue, 04 Apr 2000 13:30:49 -0700

[email-masked] said:
> Choosing case preservation, but insensitive matching was not an
> acceptable solution, because in such environments where case
> sensitivity mattered, the consequence for the security of the system
> could be significant.

Please pardon my ignorance here: I'm curious about what consequential 
vulnerabilities you're postulating here. A specific concrete example would 
help, too.

thanks, 

JeffH

-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Clifford Neuman <[email-masked]>
Date: Tue, 4 Apr 2000 13:59:25 -0700 (PDT)

From: [email-masked]
   Date: Tue, 04 Apr 2000 13:30:49 -0700

If an access control list were set up and entries matched in a case
insensitive manner when a realm name was generated by systems with
case sensitive names, and where two realms shared the same name except
for case differences, then access would be granted even though the
principal was not the one intended.

Clifford Neuman