Subject: [kitten] I-D Action: draft-ietf-krb-wg-cammac-07.txt

From: [email-masked]
Date: Thu, 08 May 2014 11:49:30 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Common Authentication Technology Next Generation Working Group of the IETF.

        Title           : Kerberos Authorization Data Container Authenticated by Multiple MACs
        Authors         : Simo Sorce
                          Tom Yu
                          Thomas Hardjono
	Filename        : draft-ietf-krb-wg-cammac-07.txt
	Pages           : 9
	Date            : 2014-05-08

Abstract:
   Abstract: This document specifies a Kerberos Authorization Data
   container that supersedes AD-KDC-ISSUED.  It allows for multiple
   Message Authentication Codes (MACs) or signatures to authenticate the
   contained Authorization Data elements.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-krb-wg-cammac/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-krb-wg-cammac-07

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-krb-wg-cammac-07

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Tom Yu <[email-masked]>
Date: Tue, 20 May 2014 16:33:18 -0400

I think this is ready for Working Group Last Call if we strike out the
open questions.

The most significant technical change is to change kdc-verifier so that
it binds to the ticket.  There are significant editorial changes to the
motivation text, which hopefully reads more smoothly now.  Thanks to
Ben, Zhanna, and others who made suggestions.

Changed other-verifiers so that it encodes more compactly in the common
case where there are no Verifiers in other-verifiers.  I recall no
significant objections to this.  Made kvno and enctype optional in
Verifier-MAC.  I think there was consensus for this after people
realized that a checksum rather than ciphertext was involved.

One possible open question is whether to define some verifier that is
like the kdc-verifier but not bound to the ticket.  This would allow for
detached CAMMAC verification without needing a copy of the ticket.  I'm
inclined to defer this until there's a use case for it, because it can
probably be put in other-verifiers, and might not even require
additional specification.

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 30 May 2014 17:11:32 -0400 (EDT)

> I think this is ready for Working Group Last Call if we strike out the

I am essentially in agreement.

The key usage for the other-verifiers checksums is left as TBD, with no 
IANA request to assign a usage.  (The key usage for the kdc-verifier and 
svc-verifier seem to not be specified, as well?!)

> additional specification.

I agree that it could probably be put in other-verifiers if needed, and 
need not be specified at this time.

-Ben