Subject: I-D ACTION:draft-ietf-krb-wg-preauth-framework-02.txt

From: [email-masked]
Date: Mon, 25 Oct 2004 16:02:48 -0400

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Kerberos WG Working Group of the IETF.

	Title		: A Generalized Framework for Kerberos Preauthentication
	Author(s)	: S. Hartman
	Filename	: draft-ietf-krb-wg-preauth-framework-02.txt
	Pages		: 21
	Date		: 2004-10-25
	
Kerberos is a protocol for verifying the identity of principals
   (e.g., a workstation user or a network server) on an open network.
   The Kerberos protocol provides a mechanism called preauthentication
   for proving the identity  of a principal and for better protecting
   the long-term secret of the principal.

   This document describes a model for Kerberos preauthentication
   mechanisms.  The model describes what state in the Kerberos request a
   preauthentication mechanism is likely to change. It also describes
   how multiple preauthentication mechanisms used in the same request
   will interact.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-preauth-framework-02.txt

To remove yourself from the I-D Announcement list, send a message to 
[email-masked] with the word unsubscribe in the body of the message.  
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-krb-wg-preauth-framework-02.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-krb-wg-preauth-framework-02.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 25 Oct 2004 16:48:23 -0400

This version introduces the concept of an authentication set as I
discussed on the list.

I've never been really clear before now whether this document would
end up as a BCP, informational RFC or standards track document.  I
think it actually makes sense as a standards track document these
days.  It ends up specifying a fair bit of client and KDC behavior
particularly surrounding choice of mechanism and multi-round-trip
mechanisms.  Also, I believe the security requirements for preauth
mechanisms should be normative.

I'm less clear that this framework should be targeted at
clarifications.  I think it might make a lot of things easier if we
fold this in to extensions and just accept that complicated preauth is
hard for clarifications.

That means we'd need a DH mechanism with encrypted timestamp built in
rather than something that used composition.

--Sam