Subject: Summary of krb-wg sessions at IETF 68

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 22 Mar 2007 20:32:29 -0400 (EDT)

Kerberos Working Group - IETF 68 meeting summary

ACTION ITEMS:

  * jhutz: Consult with AD's about ECC IPR issues, and report to the list.
  * jhutz: Consult with Sam and Ken on a milestone for referrals
  * jhutz: Consult with Sam and Tom on a milestone for extensions
  * jhutz: Do a review and PROTO writeup of Set/Change Password.
  * jhutz: Start WGLC on anonymity and hash agility documents.
  * jhutz: Bring up charter items for admin protocol, iakerb, hw-auth, and otp.
  * nico: Comparison of FAST and STARTTLS
  * nico, shawn, raeburn: review draft-ietf-krb-wg-anon-03.txt
  * tgondrom: review draft-ietf-krb-wg-gss-cb-hash-agility-01.txt
  * stefan, shawn: review draft-ietf-krb-wg-pkinit-alg-agility-02.txt
  * raeburn: Summarize open issues for referrals to the mailing list.

DECISIONS (to be validated):

  * The cross-realm problem statement work will be in the charter proposal.
  * Work on at least one of FAST or STARTTLS will be in the charter proposal.

SESSION SUMMARY:

  + Larry Zhu will become co-chair sometime in the next few months.

  + There was a brief review of WG documents which have passed or are
    nearly ready for last call.

    - ECC-for-PKINIT is waiting for a PROTO writeup.
    - TCP Extensions is now in IETF last call.
    - Naming constraints is in WG last call.
    - Set Password is waiting for a PROTO writeup.
    - Anonymity should be in WGLC by the end of March.
    - The hash agility documents should be in WGLC in April.

  + The ECC-for-PKINIT document is ready, but has a normative reference
    to an informational document (RFC 3278) which specifies how to use
    ECC with CMS.  The referenced document is informational because of
    IPR issues with ECC, and the working group needs to decide whether
    we want to publish ECC-for-PKINIT as informational, or attempt to
    place it on the standards track despite the IPR issues and downref.
    Further discussion will take place on the mailing list.

  + There was discussion about the inability to determine whether GSS-API
    channel bindings have been recognized by the acceptor, and there was
    a proposal to add a criticality flag to context token extensions,
    which was ruled out of scope.

  + Work continues on the referrals and extensions documents; new versions
    of both have been submitted recently, but there are still changes to
    be folded in.  Ken Raeburn described some open issues with referrals,
    which he will bring up on the mailing list.

  + There was much discussion of items to be placed on our new charter.
    The following items were considered:
    - Work on an LDAP-based admin protocol
    - IAKERB, a mechanism for allowing communications between a GSS-API
      initiator and its KDC to be relayed by the GSS-API acceptor, when
      the initiator cannot talk to its KDC directly.
    - Examination of problems related to cross-realm authentication
    - A STARTTLS-like negotiation for using TLS to protect communication
      between Kerberos clients and the KDC.
    - A preauthentication model and framework, and several methods.

    There was strong consensus in the room that the charter proposal
    should include both the cross-realm problem work and at least one of
    STARTTLS or the FAST preauth framework.  Discussion of the admin
    protocol work was contentious and eventually deferred to the mailing
    list.  More discussion is required on IAKERB and the various preauth
    methods.