Subject: IAKERB Update from EAP Session

From: "Douglas E. Engert" <[email-masked]>
Date: Tue, 19 Nov 2002 16:56:09 -0600

Any other update on IAKERB, is the draft:

http://www.ietf.org/internet-drafts/draft-aboba-pppext-eapgss-12.txt

PPPEXT Working Group                                       Bernard Aboba
INTERNET-DRAFT                                                 Dan Simon
Category: Experimental                                         Microsoft
<draft-aboba-pppext-eapgss-12.txt>
6 April 2002

                    EAP GSS Authentication Protocol

 I have not read this, but is sounds like a replacement for IAKERB, or can use IAKERB!

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Sam Hartman <[email-masked]>
Date: Wed, 20 Nov 2002 12:50:29 -0500

It can use iakerb.

---

From: "Douglas E. Engert" <[email-masked]>
Date: Wed, 20 Nov 2002 12:47:48 -0600

> It can use iakerb.

Was this implemented? Or is the eapgss describing how it could be done?
It soulded like the eapgss used gssapi directly, but I wasnot usre if it
actually tried the IAKERB.

--

---

From: Derek Atkins <[email-masked]>
Date: 20 Nov 2002 21:30:53 -0500

> actually tried the IAKERB.

I do not know if this is implemented or not.  If it is, it is only
implemented by Microsoft.  It uses IAKERB (which is also implemented
by Microsoft).

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

---

From: Sam Hartman <[email-masked]>
Date: Thu, 21 Nov 2002 08:52:26 -0500

>>>>> "Derek" == Derek Atkins <[email-masked]> writes:

    Derek> "Douglas E. Engert" <[email-masked]> writes:
    >> Sam Hartman wrote:
    >> > 
    >> > It can use iakerb.
    >> 
    >> Was this implemented? Or is the eapgss describing how it could
    >> be done?  It soulded like the eapgss used gssapi directly, but
    >> I wasnot usre if it actually tried the IAKERB.

    Derek> I do not know if this is implemented or not.  If it is, it
    Derek> is only implemented by Microsoft.  It uses IAKERB (which is
    Derek> also implemented by Microsoft).

    Derek> -derek

Hmm, I thought this too, but was surprised when they didn't step
forward at the WG meeting and indicate they had implemented iakerb.
So you are confirming that MS has in fact implemented iakerb?

---

From: Derek Atkins <[email-masked]>
Date: 21 Nov 2002 10:43:50 -0500

> So you are confirming that MS has in fact implemented iakerb?

Well, I have not personally verified that they have it implemented,
however Bernard seemed to imply that they had it implemented.

-derek

---

From: "Douglas E. Engert" <[email-masked]>
Date: Thu, 21 Nov 2002 09:19:46 -0600

Benard, Dan,

The KRB-WG is debating the merits of the IAKERB draft. In your 
"EAP GSS Authentication Protocol" draft you indicate that it would
work with IAKERB. 

Did you actually implement IAKERB with SPNEGO?

If so,  what problems did you run into? Was the IAKERB draft
complete? Did you have to make any assumptions?

If you did not, can you say how hard it would be to implement?

Thanks.  

Doug Engert,
 KRB-WG chair.

--