Subject: Re: [Fwd: Re: Submission of draft-ietf-cat-iakerb-08.txt to IESG]

From: Jeffrey Altman <[email-masked]>
Date: Thu, 17 Oct 2002 13:07:44 EDT

> Lets look at RFC 2026:
> 
>  4.1.1  Proposed Standard
> 
>    The entry-level maturity for the standards track is "Proposed
>    Standard".  A specific action by the IESG is required to move a
>    specification onto the standards track at the "Proposed Standard"
>    level.
> 
>    A Proposed Standard specification is generally stable, has resolved
>    known design choices, is believed to be well-understood, has received
>    significant community review, and appears to enjoy enough community
>    interest to be considered valuable.  However, further experience
>    might result in a change or even retraction of the specification
>    before it advances.
>
> Many of the arguments I have head over the last few days are:
> 
>  o There might be a better way to do this.
> 
>  o No one has implemented it yet. (If anyone has, please speak up!)
> 
>  o The use of SPNEGO adds extra baggage. 
 
> We have a catch-22 here. Those interested in it are waiting for the
> draft to be a Proposed Standard before implementing. They appear to
> believe it is well-understood, as they are pushing for it to be a
> Proposed Standard. It has been in the CAT and now KRB-WG for a long
> time, and before the IESG now for a year! We might not get any
> better understanding till it is implemented.
     
> If "further experience" dictates this might result in a change or
> retraction.  If there are others who feel that there is a better
> way, with or without GSSAPI or SPNEGO, they could propose an
> alternative. But would there be enough "community interest to be
> considered valuable" for this alternative.
 
> It has stalled for a year. so I say it is time to get moving
> forward, so implementations can be tried.

Doug:

There is a fundamental different between "implementation" and
"shipping in commercial product".  

Part of the responsibility of an author is to demonstrate through
implementation that their specification is 

  . stable

  . properly designed

  . well-understood

and from that the community can

  . provide significant review

  . determine if there is appropriate levels of interest

The issues as I have heard it over the last week are:

  . there has not been significant review from the community
    because the competent community does not exist or is not
    interested

  . there have been no implementations to demonstrate the
    design works and is well understood

  . the reliance on SPNEGO not only adds perhaps unnecessary
    overhead but in fact prevents implementations from being
    created because the number of implementations of GSSAPI
    SPNEGO is so small and proprietary that those few people
    for might have the inclination to review the draft are
    unable to do so.

 Jeffrey Altman * Sr.Software Designer     Kermit 95 2.0 GUI available now!!!
 The Kermit Project @ Columbia University  SSH, Secure Telnet, Secure FTP, HTTP
 http://www.kermit-project.org/            Secured with MIT Kerberos, SRP, and 
 [email-masked]               OpenSSL.