Subject: Kerberos pre-auth framework, OTP support, hw-auth, plug-ability, and more

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 24 Oct 2006 23:05:35 -0700

I submitted -03 of draft-ietf-krb-wg-preauth-framework. The delay in its
publication is significant, as such I attached the ID via email here.

There are many common problems involved in designing a new preauth
mechanism. For example, the protection of pre-auth data, the reply key
delivery, and state management, combining keys, just to name a few.

This document attempts to provide guidelines for preauth mechanism
designers, as well as standard solutions to these common problems.

For example, Richard @ RSA suggested using DH to protect the preauth
data and various ways to protect the preauth data using pre-shared
secrets. This I-D suggests a different but more modular and generic
solution, namely anonymous PKINIT. It also defines a generic protection
mechanism using a pre-shared secret.

The voice is getting louder and louder, we simply need to build a secure
channel between the client and the KDC for pre-auth data, in order to
allow a plugin architecture. Kerberos FAST as defined in this ID is such
a protected channel. In contrast with the approach of using TLS as
suggested by Simon, it is stateless if the encrypted-timestamp is used.
In addition, it would be preferrable to make Kerberos secure by itself,
and it seems to me it can be done.

Last but not least, Mr. Shoichi Sakane has been wonderful pinpointing
issues with cross-ream operations. This I-D attempts to address those
concerns as well, but in a slightly different, and a more generic and
modular way.

Please review this I-D. it is an update to the excellent and pioneering
work Sam has done in the past.

It is my hope that the preauth framework is compatible with the
extensions. Thus it is useful within the framework of RFC4120 and that
of extension.

Since this ID is tightly related to several documents of interests, I
want to specifically call out attentions to these doc authors.

Thanks,

-- Larry