Subject: Charter discussion

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 06 Mar 2007 17:40:43 -0500

It is time to resume our charter discussion.  Based on discussions with Sam 
and comments received at the last meeting, I've refined my charter update 
proposal; the latest version can be found at the end of this message.  The 
primary open issues are these:

(1) Is there any interest in advancing Kerberos V5.2, PKINIT, and/or the
    GSS-API mechanism beyond Proposed?  If these items are not important
    to anyone, or if there is no one to work on them, then we will need to
    drop them from the charter.

(2) Rather than an open-ended task to work on any preauth proposal that
    comes along, we should have a specific list of mechanisms on which
    we will focus.  That means we need to decide which mechanisms should
    be in that list.  I'm starting a separate thread on that topic.

(3) Do we want to adopt Simon's STARTTLS proposal?

(4) Do we want to adopt a work item to examine cross-realm issues?

(5) Do we want to adopt the data model / LDAP schema / admin work?

(6) Milestones

-- Jeff

===== Proposed Charter =====

Kerberos over the years has been ported to virtually every operating
system.  There are at least two open source versions, with numerous
commercial versions based on these and other proprietary implementations.
Kerberos evolution has continued in recent years, with the development
of a new crypto framework, publication of a new version of the Kerberos
specification, support for initial authentication using public keys, and
numerous extensions developed in and out of the IETF.

However, wider deployment and advances in technology bring with them both
new challenges and new opportunities, particularly with regard to making
initial authentication of users to the Kerberos system both convenient
and secure.  In addition, several key feature remain undefined.

The Kerberos Working Group will advance the state of the core Kerberos
specification, produce specifications for missing functionality, and
develop extensions to address new needs and technologies related to
improving the process of client authentication.

Specifically, the Working Group will:

* Complete existing work:
   [most of these should be done by charter time]
   - TCP Extensibility         (draft-ietf-krb-wg-tcp-expansion-01.txt)
   - ECC for PKINIT            (draft-zhu-pkinit-ecc-03.txt)
   - Set/Change Password 
(draft-ietf-krb-wg-kerberos-set-passwd-05.txt)
   - Naming Constraints        (draft-ietf-krb-wg-naming-02.txt)
   - Anonymity                 (draft-ietf-krb-wg-anon-03.txt)
   - Hash agility for GSS-KRB5 
(draft-ietf-krb-wg-gss-cb-hash-agility-00.txt)
   - Hash agility for PKINIT   (draft-ietf-krb-wg-pkinit-alg-agility-01.txt)
   - Referrals                 (draft-ietf-krb-wg-kerberos-referrals-08.txt)

* Advance the following existing specifications along the standards track:
  [we will drop these items if no one expresses interest in working on them]
  - Kerberos V5 specification 2 (RFC's 3961, 3962, 4120),
  - PKINIT (RFC's 4556 and 4557)
  - The Kerberos GSS-API mechanism (RFC 4121).

* Prepare and advance a specification for an updated, backward-compatible
  version of the Kerberos version 5 protocol which supports non-ASCII
  principal and realm names, salt strings, and passwords; insures that
  those portions of the protocol which are not encrypted are nonetheless
  authenticated whenever possible; and enables future protocol revisions
  and extensions.
  [ draft-ietf-krb-wg-rfc1510ter-03.txt ]

* Develop extensions which reduce or eliminate exposure of Kerberos
  clients' long-term keys to attack and enable the use of alternate
  mechanisms for initial authentication.  This task will comprise the
  following items:
    [ This will be an specific list, resulting from discussion. ]

* Examine issues related to the current cross-realm model, produce a
  list of problems to be solved, and evaluate approaches to solving them.

* Produce a data model for information needed by the KDC, and an LDAP
  schema for management of that data.

Goals and Milestones:

   --DONE--  TCP Extensibility to IESG
   MAR 2007  ECC for PKINIT to IESG
   MAR 2007  Set/Change Password to IESG

   APR 2007  Naming Constraints to IESG
   APR 2007  Anonymity to IESG
   APR 2007  Hash agility for GSS-KRB5 to IESG
   APR 2007  Hash agility for PKINIT to IESG

   mmm yyyy  WGLC on Referrals
   mmm yyyy  WGLC on RFC1510ter

   mmm yyyy  WGLC on STARTTLS [if accepted]
   mmm yyyy  [ first-draft or WGLC for each preauth mech ]

   mmm yyyy  WGLC on cross-realm issues
   mmm yyyy  WGLC on data model

   mmm yyyy  first-draft of advancing 3961/3962/4120
   mmm yyyy  first-draft of advancing 4556/4557
   mmm yyyy  first-draft of advancing 4121

---

From: Shoichi Sakane <[email-masked]>
Date: Mon, 12 Mar 2007 20:31:23 +0900

Hi Jeff and all,

Jeffrey Hutzelman wrote:
> It is time to resume our charter discussion.  Based on discussions with
> Sam and comments received at the last meeting, I've refined my charter
> update proposal; the latest version can be found at the end of this
> message.  The primary open issues are these:

>  list of problems to be solved, and evaluate approaches to solving them.

Please let me summarize the work so far related to the item #4,
cross-realm issues, and please let me talk about my opinion.

As the first step, I wrote a document that lists cross-realm issues
and defines the problems, which is probably included well-known problems.
The current draft is draft-sakane-krb-cross-problem-statement-01.txt.
I think that this document includes most of problems related to not
only specific area, but also typical network environment though the
title of the document uses "specific environtment".  If those things
are not enough to move our process forward, I need more input in order
to find out the other issues and problems.  Then we can evaluate
approaches.

As our next step, it is maybe too early to consider, Ken'ichi and I
have proposed a model to solve most of problems that described in the
problem statement document.
The current draft is draft-kamada-krb-client-friendly-cross-01.txt.
I announced my previous mail.  This document proposes a model
constructed by two modes.

Third, PK-CROSS will become obviously one of approaches to solve problems.
The second proposed document also mentions the mechanism.  I would like
to put this mechanism on the table again though I am not sure whether the
authors are focusing it still.  I will ask them.  If they don't have time,
I am ready to be editor or something like that.  I would like to have
any comment about my thought please.

Finally, Saber and others, including me, are proposing another approach
to solve cross-realm problem.
The current draft is draft-zrelli-krb-xtgsp-01.txt.
This approach is lettle different from the model that I proposed in previous
document.  However, this approach has an advantage, this is also mentioned
at the second proposed document.  We also have to evaluate it.

These are current status related to cross-realm work which I know.
IMHO, if there are some people interested in the item, we probably need
a small meeting at Prague.  I will send a request on another mail.

In summarize, we have four documents so far.
1. draft-sakane-krb-cross-problem-statement-01.txt.
2. draft-kamada-krb-client-friendly-cross-01.txt.
3. draft-ietf-cat-kerberos-pk-cross-08.txt (expired)
4. draft-zrelli-krb-xtgsp-01.txt.

Any comments and information are welcome.

Regards,

---

From: Quanah Gibson-Mount <[email-masked]>
Date: Wed, 14 Mar 2007 09:39:53 -0700

>   schema for management of that data.

Is there any initial round of work that has been done on the LDAP schema 
that I could look at?  What steps are things waiting on here? etc.  Since 
I'm new to the list and unfamiliar with where things stand. :)

Thanks,
Quanah

--
Quanah Gibson-Mount
Principal Software Developer
ITS/Shared Application Services
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

---

From: Sam Hartman <[email-masked]>
Date: Wed, 14 Mar 2007 14:01:16 -0400

>>>>> "Quanah" == Quanah Gibson-Mount <[email-masked]> writes:

    Quanah> --On Tuesday, March 06, 2007 5:40 PM -0500 Jeffrey
    Quanah> Hutzelman

    >> * Produce a data model for information needed by the KDC, and
    >> an LDAP schema for management of that data.

    Quanah> Is there any initial round of work that has been done on
    Quanah> the LDAP schema that I could look at?  What steps are
    Quanah> things waiting on here?  etc.  Since I'm new to the list
    Quanah> and unfamiliar with where things stand. :)

There has been some work done on a schema, but I think we'd rather
work on a data model before a schema.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 16 Mar 2007 16:26:01 -0400

> to find out the other issues and problems.  Then we can evaluate

Right.  The proposed agenda item is for the working group to produce and 
publish a problem statement, presumably starting from your draft.  The idea 
is that once that is done, we'll evaluate possible approaches to solving 
the problems, select some, and get our charter amended to allow us to work 
on them.  I'd prefer not to put the cart before the horse by discussing the 
details of proposed solutions before we've even agreed on what the problems 
are, or on what are the constraints for solving them.

> any comment about my thought please.

Work on PKCROSS was suspended because it had dependencies on PKINIT, which 
took a long time to complete, and because it required the use of ticket 
extensions, a feature that does not appear in RFC4120 but which does appear 
in draft-ietf-krb-wg-rfc1510ter, one of our current work items.  Most of 
the authors of that document are no longer active in this working group, 
but that doesn't mean the work can't proceed -- if we decide to pick it up, 
we'll find an editor.

> a small meeting at Prague.  I will send a request on another mail.

I expect to spend some time on Monday discussion whether we want to include 
an item in our charter to work on cross-realm issues, and exactly what form 
that item should take.

-- Jeff