Subject: Re: Protocol Action: 'Public Key Cryptography for Initial Authentication in Kerberos' to Proposed Standard

From: Jeffrey Altman <[email-masked]>
Date: Fri, 24 Feb 2006 10:18:56 -0500

Congrats!!!!

This has been a very long time coming.

Jeffrey Altman

The IESG wrote:
> The IESG has approved the following documents:
> 
> - 'Public Key Cryptography for Initial Authentication in Kerberos '
>    <draft-ietf-cat-kerberos-pk-init-34.txt> as a Proposed Standard
> - 'OCSP Support for PKINIT '
>    <draft-ietf-krb-wg-ocsp-for-pkinit-06.txt> as a Proposed Standard

---

From: The IESG <[email-masked]>
Date: Fri, 24 Feb 2006 10:11:42 -0500

These documents are products of the Kerberos WG Working Group. 

The IESG contact persons are Sam Hartman and Russ Housley.

A URL of this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-cat-kerberos-pk-init-34.txt

Technical Summary
 
   This document describes protocol extensions (hereafter called PKINIT)
   to the Kerberos protocol specification.  These extensions provide a
   method for integrating public key cryptography into the initial
   authentication exchange, by using asymmetric-key signature and/or
   encryption algorithms in pre-authentication data fields.  A
companion document describes the use of OCSP with this protocol. 

Working Group Summary
 
   This document is the result of work begun nearly 10 years ago in
   the CAT working group.  In that time the two working groups have
   focused much of their energy on this work, resulting in quite a lot
   of discussion, some heated debate, and a few compromises.  Due to
   timing constraints, one significant stakeholder was forced to adopt
   and deploy an early version of this specification, rather than
   waiting for the final product.  While we regret being unable to
   meet their timeline, much of the intervening time was well-spent,
   and we think the protocol is significantly improved as a result.

   This document represents the consensus of the Kerberos Working
Group.

Protocol Quality
 
   Several major Kerberos implementors have indicated an intent to
   implement this protocol; some have done so already.  While the
   current version has not yet been widely deployed, significant
   experience has been gained by wide deployment of earlier versions
   of this protocol.  This protocol was reviewed by Jeffrey Hutzelman
and Sam Hartman.

Note to RFC Editor
  Please make the following changes in draft-ietf-cat-kerberos-pk-init:

  In section 1:

    OLD: The corner-stone of Kerberos V5 is the Ticket and the Authenticator.
    NEW: The corner-stones of Kerberos V5 are the Ticket and the Authenticator.

  In section 3.1.3:

    OLD:

      All structures defined in or imported into this document MUST be
      encoded using Distinguished Encoding Rules (DER) [X680] [X690]
      (unless otherwise noted).  All data structures carried in OCTET
      STRINGs must be encoded according to the rules specified in
      corresponding specifications.

    NEW:

      All structures defined in or imported into this document MUST be
      encoded using Distinguished Encoding Rules (DER) [X680] [X690]
      (unless otherwise noted).  All data structures carried in OCTET
      STRINGs MUST be encoded according to the rules specified in the
      specifications defining each data structure; a reference to the
      appropriate specification is provided for each data structure.

  In section 4:

    OLD: In addition, if any CA is trusted to issue KDC certificates can
    NEW: In addition, if any CA that is trusted to issue KDC certificates can

  Add at the end of section 4:

    NEW:

      The key usage number 6 used by the asChecksum field is also used
      for the authenticator checksum (cksum field of AP-REQ) contained
      in the PA-TGS-REQ preauthentication data contained in a TGS-REQ
      [RFC4120].  This conflict is present for historical reasons; the
      reuse of key usage numbers is strongly discouraged.

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 24 Feb 2006 11:41:09 -0600

>    <draft-ietf-krb-wg-ocsp-for-pkinit-06.txt> as a Proposed Standard

Woohoo!

Thanks Brian, Larry and everyone else.

---

From: Brian Tung <[email-masked]>
Date: Fri, 24 Feb 2006 10:08:55 -0800

> Thanks Brian, Larry and everyone else.

Thanks for most of the entire final push must go to Larry, who has been
Driving Force Majeure <g> in the last year.

-- 
Brian Tung <[email-masked]>
USC Information Sciences Institute

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 24 Feb 2006 10:27:30 -0800

I sat on giants' shoulder. Hats off to you Brian for keeping this going
over the years. It finally paid off. 

Thanks Sam for sheepherding this to completion. Thanks Jeff (jhutz) for
driving this with me. Thanks Jeff (jaltman) and Nico for your support.
Thanks Chaskiel for your wonderful reviews in the last days of this ID.
Thanks Love for your support and your relentless criticism, without
that, we could not get to this stage.

Thanks David Cross at Microsoft for being supper supportive along the
process, without that I would not have made this far.

Thanks Paul Leach at Microsoft for being an anonymous hero for this
work.

Thanks everyone I have not mentioned by name, who has contributed and
had a genuine interest to see this work done.

Thanks Jk at Microsoft, Microsoft Kerberos team and Love for the PKINIT
interop event at the end of 2005. It shows to the world that it does
interop.

Today is the history, and I am happy, finally.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Brian Tung
Sent: Friday, February 24, 2006 10:09 AM
To: krb-wg mailing list
Subject: Re: Protocol Action: 'Public Key Cryptography for Initial
Authentication in Kerberos' to Proposed Standard