Subject: [Ietf-krb-wg] summary of the activity about cross-realm

From: Shoichi Sakane <[email-masked]>
Date: Fri, 07 Dec 2007 10:48:59 +0900

Hi All,

This is the summary of the activities and the status of them which
I know about the issues of the cross-realm operation.  If there are
activities except of the following list, and if you are intested in
solving some of the cross-realm issues, including other issue which
is not described here, I would like to share any information, and
I would like to work togather if possible.

Any comments, any questions and any helps are welcome.

The summary:

Cross Realm Problem Statement
        (draft-ietf-krb-wg-cross-problem-statement-01.txt)
        This draft shows a background to which the Kerberos system
        would be applied, in order to make sense why there are some
        issues related to the cross-realm operation.  This draft also
        lists six typical issues:
                - Unreliability of authentication chain
                - Possibility of MITM in case of the indirect trust model
                - Scalability of the direct trust model
                - Exposure to DoS Attacks
                - Client's performance
                - Pre-authentication problem in roaming scenarios
        This draft is not intended to force the krb-wg to make any tasks
        with solving each of issues.  The members need to consider
        which issues should be solved as the next step.
        A three-week last call within the krb-wg is announced by the chairs.

XTGSP
        (draft-zrelli-krb-xtgsp-01.txt)
        XTGS is a kind of providing the solutions to reduce
        the client burden, to make a relationship between
        the local KDC and the final KDC directly.
        Currently, the version -01 of the specification was expired.
        but the authors are going to improve the specification,
        and will plan to publish a new draft after that.

Client Friendly Model
        (draft-kamada-krb-client-friendly-cross-03.txt)
        CFM proposes two modes in order to reduce the burden of the
        kerberos client.  Recursive Ticketing Mode is that the KDC
        gets a ticket of the client from the remote KDC like a proxy.
        Dynamic Cross Mode is to make an inter-realm relationship.
        This proposal is ready to put on the table anytime.

PKCROSS
        (draft-ietf-cat-kerberos-pk-cross-08.txt)
        Kamada-san are implementing the PKCROSS into the Heimdal 1.0.1.
        Basic functions work.  the modification is based on multithreading
        to avoid blocking the main service.  namaly, while the KDC is
        making a relationship with the peer in PKINITing, his
        implementation does not block the services of the KDC.
        He got some experiences.  some of them should be described into
        the PKCROSS draft although the version -08 had been expired.

-- 
Shoichi Sakane
Yokogawa Electric Corporation
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg