Subject: Re: [Ietf-krb-wg] WGLC comments on draft-ietf-krb-wg-gss-cb-hash-agility-03.txt

From: "Shawn M. Emery" <[email-masked]>
Date: Mon, 03 Dec 2007 23:54:59 -0700

Jeffrey Hutzelman wrote:
> These are WG comments for draft-ietf-krb-wg-gss-cb-hash-agility-03.txt.
> I've re-reviewed this document for WGLC, and found that all of the
> comments I originally raised on the -00 version have been addressed.
> Overall, this document looks to be in good shape.  I have only three new
> comments, but I think we need to address all of them before the document
> will be ready to move forward.
>
>
> [JTH.1] (Abstract)  Since this document updates RFC4121, the abstract needs
> to say so.
>   
Done.
> [JTH.2] (Section 3)  This section makes reference to a key usage number
> "TBD".  If the goal is to avoid collisions with existing uses in Kerberos,
> the GSS-API mechanism, and related protocols, then this requires us to
> assign a number which does not conflict with those listed in section 7.5.1
> or RFC4120.  Currently, Tom Yu is the keeper of that database.
>   
He assigned 43 for me.
> [JTH.3] (Section 5)  This section establishes a new registry for Kerberos V
> GSS-API mechanism extension types, which is a 32-bit space.  It specifies
> the registration policy for these numbers as "IESG Protocol Action", but
> neither details what that means nor makes reference to a source which does
> so.  The namespace should be divided into one or more parts, with the
> registration policy for each being set down clearly either via explicit
> description or a reference to one of the policies described in RFC2434.
>
> These policies need to be the result of a WG discussion on this issue.
> To that end...
>
> <hat role="WG chair" status="off">
>
> Personally, I think applying a registration policy like "IESG Approval" to
> the entire namespace is far too restrictive.  Given the size of the
> namespace, it is probably appropriate to set aside a small portion for
> Private Use, possibly reserve some part to be assigned by IESG Approval or
> perhaps IETF Consensus, and use Specification Required or First Come First
> Served for the rest.  It's unlikely that we're going to exhaust this
> namespace.
>
> </hat>
>   

I agree.  Here's an initial proposal:

   The IANA is hereby requested to create a new registry of "Kerberos V
   GSS-API mechanism extension types" with four-field entries (type
   number, type name, description, and normative reference) and,
   initially, a single registration: 0x00000000, "Channel Binding MIC,"
   "Extension for hash function-agile channel binding," <this RFC>.

   Following the policies outlined in [RFC2434], type numbers 0-1023 are
   allocated as IETF Consensus, type numbers 1024-4095 are allocated for
   Private Use, and type numbers greater than or equal to 4096 are allocated
   as Specification Required.

Shawn.
--
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: "Shawn M. Emery" <[email-masked]>
Date: Tue, 04 Dec 2007 16:58:47 -0700

Or to more easily make Private Use checks:
 
0x00000000 - 0x000003FF      IETF Consensus
0x00000400 - 0xFFFFF3FF     Specification Required
0xFFFFF400 - 0xFFFFFFFF    Private Use

Shawn.
--
> Shawn M. Emery wrote: