Subject: RE: RC4-HMAC

From: "John Brezak" <[email-masked]>
Date: Mon, 4 Dec 2000 17:19:20 -0800

A few clarifications:
- The initial intent of the RC4-HMAC I-D was to publish it as
informational for those folks that want to interoperate with Win2000.
- KD values and the assigned values represent the "experimental" nature
of the protocol and lessons learned during implementation (bugs if you
will).

If this is to proceed on a standards track, then these issues should be
cleaned up, however the informational nature of the I-D is still very
relevant to at least the win2000 implementation.

Heimdal has implemented the RC4-HMAC enctype and a few others that are
not public. The latest posting reflects changes pointed out during
implementations from the earlier versions.

-----Original Message-----
From: Ken Raeburn [mailto:[email-masked]]
Sent: Monday, December 04, 2000 2:12 PM
To: [email-masked]
Subject: RC4-HMAC

Doug put this on the agenda:

  RC4-HMAC as "standard" etype - John Brezak (Microsoft)
        John reports that there are at least 3 implementations of
        Kerberos which have this, so should it be standard? 

I didn't realize it, because it hadn't been announced here (AFAICT), but
there's a new draft (draft-brezak-win2k-krb-rc4-hmac-02.txt) that came
out in November, and it looks significantly different from the -00 and
-01 versions.

It incorporates key derivation "as defined in RFC1510bis" (or similar
language), and then goes on to describe a completely different mechanism
using an MD5 HMAC.  A different list of key usage numbers that doesn't
match up with all the uses in RFC1510bis is also given, with no
explanation for the changes; making one implementation handle both will
be a pain in the backside, though a sort of translation table from
RFC1510bis numbers to RC4 numbers might work.  There were some other
bits I had questions on (mostly the reasoning for certain decisions),
but I'd have to go back and check it again.  I did notice the checksum
number chosen for HMAC MD5 is still negative -- that is, in the "local
use" range.  If it's going to be an IETF standard, it should have a
positive number, IMNSHO.

My main question is:
  Which versions of this spec have been implemented (and by whom), and
  what version are we talking about making a standard?

Ken

---

From: Ken Raeburn <[email-masked]>
Date: 04 Dec 2000 20:44:50 -0500

> relevant to at least the win2000 implementation.

Sure.  The main thing is, is it to be an Informational RFC or
standards-track?  If it's informational, then it should describe what
Win2000 is doing well enough to make an interoperable implementation.
If it's standards track, it should conform to the Kerberos spec or
give a good reason why it the divergence was necessary.  (IMO, of
course.)

Jeff Schiller suggested that I go with Informational for the 3DES
GSSAPI spec, because eventually we ought to go with a new mechanism
that better utilizes the existing Kerberos messages and encryption
scheme definitions rather than re-inventing them.  The 3DES extensions
are not intended to be what we want everyone to settle on, just an
intermediate measure for better security in the short term.

> implementations from the earlier versions.

Just to be clear: Heimdal's implemented the -02 version then?

Ken