Anonymity Support for Kerberos
draft-ietf-krb-wg-anon-12

[Ballot comment]
1) Refer to RFC 5652 vice RFC 3852.

2) Sec 4.1.1: This is pretty nit-noid, but the certificates field is OPTIONAL in the ASN so it might be better to say absent as opposed to empty.  The signerInfos field isn't OPTIONAL so empty is correct.  It's up to you whether you should change this.

[Ballot comment]
Please consider the comments made by Elwyn Davies in the Gen-ART
  Review posted on 10 September 2010.  The review can be found here:

    http://www.softarmor.com/rai/temp-gen-art/
    draft-krb-wg-ananon-12-davies.txt

[Ballot comment]
The Security Considerations note that "Because there are plaintext parts of the tickets that are exposed on the wire, such matching by a third party observer is relatively straightforward." Presumably the use of transport layer security would minimize the attack surface here, so at least an informative reference to draft-josefsson-kerberos5-starttls might be appropriate.

[Ballot comment]
idnits (http://tools.ietf.org/tools/idnits/) notes a few issues with
references that other ADs have noted, and one problem with format. It
would be good to sort these out.

---

I like the acknowledgement...

  Sam Hartman and Nicolas Williams were great champions of this work.

It is so often the case that document authors do not champion their
work :-)

[Ballot comment]
Section 4.2:

  The TGS SHOULD NOT
  populate identity-based authorization data into an anonymous ticket
  in that such authorization data typically reveals the client's
  identity.

MUST?  Or, under what conditions can the TGS violate the SHOULD NOT?

Section 7:

  The padata-value field of the PA-PKINIT-KX type padata contains the
  DER [X680] [X690] encoding of the Abstract Syntax Notation One
  (ASN.1) type PA-PKINIT-KX.

Are [X680] and [X690] citations?  There are no matching references in the References section.

IANA understands that the IANA actions in this document are dependent
upon approval of another document:

http://tools.ietf.org/html/draft-ietf-krb-wg-naming-07

If both the current document and the krb-wg-naming document are
approved, IANA understands that there are two IANA Actions to be completed.

First, IANA will create a new 'anonymous' Kerberos well-known name in
the registry created in:

http://tools.ietf.org/html/draft-ietf-krb-wg-naming-07

Second, IANA will create a new 'anonymous' Kerberos well-known realm
based in the registry created in:

http://tools.ietf.org/html/draft-ietf-krb-wg-naming-07

IANA understands that these are the only actions that will need to be
completed upon approval of this document (and the approval of the
dependent krb-wg-naming document).

IANA Last Call comments:

[ Note: registries will be created by draft-ietf-krb-wg-naming-04.txt ]

Action 1

Upon approval of this document, the IANA will make the following
assignments in the "Well Known Kerberos Names" registry located at
http://www.iana.org/assignments/TBD
sub-registry "Well Known Principal Names"

Well Known Principal Names Reference
-------------------------- --------------------
WELLKNOWN/ANONYMOUS [RFC-krb-wg-anon-05]


Action 2:

Upon approval of this document, the IANA will make the following
assignments in the "Well Known Kerberos Names" registry located at
http://www.iana.org/assignments/TBD
sub-registry "Well Known Realm Names"


Well Known Realm Names Reference
---------------------- --------------------
WELLKNOWN:ANONYMOUS [RFC-krb-wg-anon-05]