Subject: Kerberos Extensions

From: Clifford Neuman <[email-masked]>
Date: Mon, 6 Nov 2006 22:20:57 -0800 (PST)

Unfortunately I am unable to attend this IETF and I will be on a plane
during the time of the Kerberos working group meeting.

I agree with the general feeling that it is time for us to move toward
some progress on Kerberos Extensions.  In addition to discussion the
extensions document itself, I think that we need to come up with a
planned course of action regarding the extensions and how we expect
them to be viewed/implemented.

In particular, is it expect that the extensions document will obsolete
RFC4120, or will be be an alternative implementation.  

Looking at rfc1510ter-03 I can not really tell the answer to the
question above.  The document is written with an ambiguous intent.
The intro states:

   This document describes a framework which enables
   backwards-compatible extensions to the Kerberos protocol.

Which would indicate to me that this describes the framework for
supporting backwards compatible extensions, but it incorporates much
of RFC1510.  

First, shouldn't it instead be providing the compatibility with 4120.
And then, wouldn't it be better to focus on the extensions, as it
claims is its intent in the introduction.

Personally, I would like to see this as a much shorter document with a
much cleaner separation between what is extensions, and what is the
basic protocol.  Thus, this document should extend or update 4120 (I'm
not sure of the right word here), rather than replace it.

Unfortunately, I will not be able to participate in the session, but I
would like those who are present and who are affected by this -
especially those with existing implementations, to discuss this.

Clifford Neuman

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 7 Nov 2006 01:59:55 -0800

I support splitting the document into one that is just about extensions.
I also found the document unmanageable.
The extension document has been the focus of the group for quite some
time, it does not help us doing useful and relevant things, if no
implementers in the working group has expressed interests implementing
the protocol.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Clifford Neuman
Sent: Monday, November 06, 2006 10:21 PM
To: [email-masked]
Subject: Kerberos Extensions

Clifford Neuman

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 15 Nov 2006 16:28:27 -0500

> not sure of the right word here), rather than replace it.

I think it's worth noting that "kerberos-extensions" has always been poorly 
named.  It's not a collection of extensions to Kerberos; it's essentially a 
new version of the core protocol, which is why "rfc1510ter" is a much more 
accurate name.

So, if you're reading this document and skimming past the new message 
types, rules for deciding when to use them, internationalization, etc, and 
wondering "where are the extensions?", the answer is that there really 
aren't many.  It's more about enabling extensions, and making other key 
improvements, than about actually defining extensions.

So sure, this could be done as a document which only describes the new 
messages and the many ways in which the new protocol differs from RFC4120, 
but I'm not convinced that document would be any easier to read than one 
which simply obsoletes 4120.

Just my $0.02.

-- Jeff