Subject: Draft Minutes of KRB-WG at Pittsburgh IETF

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 07 Aug 2000 16:06:13 -0500

Attached ar my draft minutes of the Kerberos-WG meeting held last week.
If any attendees have additions or corrections to offer, please send them no 
later than August 14, to support timely submission to the secretariat.

Thanks to Ken, Ken, Pat and Cliff for their notes, and to many of the speakers
who sent in their presentations. 

MINUTES KERBEROS-WG Meeting 8/2/00 - Pittsburgh  IETF

The first meeting of the Kerberos WG was held 8/2/2000 in Pittsburgh with 79 
attendees in a room designed for 60. The Chairman, Doug Engert <[email-masked]> 
gave a short introduction about the new group beeing split from the CAT group in 
order to focus on the Kerberos specific drafts, and to get the Kerberos-Revisions
to last call in August. The charter can be found at 
http://www.ietf.org/html.charters/krb-wg-charter.html.  

Cliff Neuman <[email-masked]> lead the discussions of the Kerberos-Revisions, 
draft-ietf-cat-kerberos-revisions-06.txt. Many other documents are being gated
by the Revisions, including a PKIX document, so getting the revisions to last-call
is the primary objective of the WG. Informal last-call sections of the draft will 
be sent to the mailing list. When done, a last-call can be made for the document. 

Microsoft has sent a letter claiming Intellectual Property rights to  parts of the
revisions. This did not appear to be a problem, as it is worded the same as previous 
letters from Microsoft to the IETF. 

The domain based realm name language has been changed for compatibility. The e-data 
values (typed data) and the pa-data namespaces were merged, but the explanation 
of this merging needs to be made more clear.  There are character set encodings 
issues (change in PKINIT, but left in revisions). For compatibility, these need 
to be left as general string. But it was pointed out the string should be 
interpreted as UTF8. This has comparison issues.  Tom Yu will send text about
how to interpret this field to provide maximum compatibility with existing deployments. 

The wording on subkeys needs to strongly recommend including of entropy from 
session key. The 40 bit des example needs to be changed. The references to 
the Horowitz drafts for 3DES and key derivation need to be incorporated. 
Ken Raeburn, has an issue with the ivec for krb_priv. Tom Yu will provide text
on changing application tags for krb-priv and krb-safe to deal
with fields that are now optional fields.

There was some clarification that was need for name referrals, in particular
how this was intended to be used. 

Cliff also gave an update of PKINIT, PKCROSS, PKTAPP. They are blocked by the
revisions.

Jonathan Trostle <[email-masked]> discussed IAKERB. Basically, have a IAKERB 
proxy server talk to the KDC in the case of the client not being able to talk to 
a KDC. Ken Raeburn asked about having the the IAKERB proxy add the correct IP 
address to the ticket at AS_REQ time.  Jonathan said he would look at that; Ted 
asked about possibly using GSS channel bindings to let the client communicate 
that; Tom Yu said that those aren't required to be transmitted. These need to be 
taken to the list. 

Jonathan Trostle discussed the Kerberos Set/Change Password document. This extends
the Horowitz original kerb-change-password protocol but allows administrative
commands to set passwords. Again there was discussion about the client generating
keys. This need further discussion on the list.  

Donna Skibbie <[email-masked]> give an overview of LDAP access to KDC databases.
The OpenGroup is working on this as well. There where many comments and questions 
about how the keys would be protected, authentication done for the database and how 
backups are controlled.   

Ken Hornstein <[email-masked]> discussed Distributing Kerberos KDC and 
Realm Information with DNS. Ken reported that most of the concerns about this draft 
were resolved at Adelaide.  A new draft needs to be reissued with beefed up security
statement and resolution of mixed-case realms.  Paul Leach asked if
the same concern he expressed before still existed; Ken confirmed that
this was still the case. 

Sasha Medvinsky <[email-masked]> reported on "Kerberos V Authentication Mode 
for Uninitialized Clients". This is a new work to use Kerberos for DHCP, with 
a IAKERB like intermediate server on the local network. The use of port 88 was 
questioned, as well as negative host type numbers. Ken Hornstein did a quick 
presentation about the alternative proposal.

Tatu Ylonen <[email-masked]> gave a brief report on Kerberos Authentication in SSH. 
This was the same report as was given to the SSH WG. There where a number of concerns
as to how this was being implemented, including the mapping of principal to local
account. It was suggested that GSSAPI be used rather then Kerberos directly. 

Jeff Altman <[email-masked]> announced the intent to form a Kerberos Telnet
working group. This would deal with adding Kerberos authentication to telnet,
most likely using GSSAPI. 

The meeting lasted just over 2 hours.  
-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444