Subject: [Ietf-krb-wg] Draft agenda for IETF 71

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 27 Feb 2008 17:24:01 -0500

I have posted a draft agenda for our meeting at IETF71, at
<http://www.ietf.org/proceedings/08mar/agenda/krb-wg.txt>

Please review and send any comments to Larry and myself.  We will also 
still entertain requests for agenda time.

-- Jeff
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 28 Feb 2008 11:17:47 +0100

> still entertain requests for agenda time.

I won't attend IETF71, but I'm curious about what the status is of the
starttls document.  I addressed the channel binding concerns earlier,
and requested a PA-DATA extension integer for it, but there were no
response.

http://thread.gmane.org/gmane.ietf.krb-wg/5015/focus=5020

When I approached an AD about publishing this document a long time ago,
it was suggested that I try to move this forward in the KRB-WG.  The
document have benefited from review of the KRB-WG (thanks!), but it has
taken a long time to get a yes/no whether to adopt the document.  The
protocol is deployed, and I think it would be useful to document this
for the community.  To allocate the required IANA number requires IESG
approval, so publishing it as an RFC seems like the simplest solution.

I'd appreciate if a decision on this could be reached.

/Simon

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 28 Feb 2008 13:26:29 -0500

--On Thursday, February 28, 2008 11:17:47 AM +0100 Simon Josefsson 
<[email-masked]> wrote:

> taken a long time to get a yes/no whether to adopt the document.

I believe we agreed to adopt this document as a WG item quite some time 
ago.  It appears as part of one of our charter items(*), and as a 
milestone.  It doesn't appear that the tools are treating this draft as a 
working-group draft, which is an oversight I will correct shortly.

> The
> for the community.

I think we all agree on that.  This document has been blocked primarily 
because we have been waiting to determine its intended status; we cannot 
send it along to the IESG without knowing this.  In turn, one input to that 
determination is whether we want to proceed with a direction for the next 
Kerberos specification in which STARTTLS will be mandatory-to-implement.

Discussion on the preferred approach for the next Kerberos specification 
would be welcome, as would direct discussion of the intended status of the 
STARTTLS document.

-- Jeff

* Note that the IETF web site currently shows an out-of-date charter;
  I've sent mail to ietf-action about getting that fixed.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 28 Feb 2008 16:01:10 -0500

--On Thursday, February 28, 2008 01:26:29 PM -0500 Jeffrey Hutzelman 
<[email-masked]> wrote:

> send it along to the IESG without knowing this.  In turn, one input to
> that  determination is whether we want to proceed with a direction for
> the next  Kerberos specification in which STARTTLS will be
> mandatory-to-implement.
>
> would be welcome, as would direct discussion of the intended status of
> the  STARTTLS document.

Looking at our charter in more detail, it seems to me that maybe we're 
including too many dependencies...

The charter includes the following item:

 * Develop extensions which reduce or eliminate exposure of Kerberos
   clients' long-term keys to attack and enable the use of alternate
   mechanisms for initial authentication. This task will comprise the
   following items:
   - A model and framework for preauthentication mechanisms
   - A mechanism for providing a protected channel for carrying
     preauthentication data and/or a reply key between a Kerberos
     client and KDC, within the KDC_REQ/KDC_REP exchange.
   - Support for One-Time Passwords
   - Support for hardware authentication tokens
   - Support for using TLS to secure communications with Kerberos KDCs.

So, it is clear that we have agreed to do both the FAST and TLS work.
It seems clear that support for at least one of these will be REQUIRED
in Kerberos 5.3.  It becomes clearer to me every day that we can separate 
the question of which one (or both) will be REQUIRED from the question of 
whether we will take the use of FAST or STARTTLS to indicate support for 
Kerberos 5.3, and that we probably should do so.

If anyone thinks it's essential to decide the negotiation question before 
we can decide which of STARTTLS and FAST will be required, or before we can 
decide the intended status of STARTTLS, I'd like to hear why.

Otherwise, I want to talk about those issues, with an eye toward being able 
to begin a WGLC on STARTTLS before the end of March.

-- Jeff

---

From: Sam Hartman <[email-masked]>
Date: Thu, 28 Feb 2008 16:10:36 -0500

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> If anyone thinks it's essential to decide the negotiation
    Jeffrey> question before we can decide which of STARTTLS and FAST
    Jeffrey> will be required, or before we can decide the intended
    Jeffrey> status of STARTTLS, I'd like to hear why.
I don't think it is essential to decide the negotiation questions
before the others.  I do think that if FAST or starttls is only used
with kerberos 5.3 then it would make kerberos 5.3 simpler.  So, since
there is value in deciding some of the questions together, I think it
requires active support to separate them.

If Simon wants to move starttls forward now, I think that sounds like
active support for decoupling starttls from Kerberos 5.3.

I do not object to decoupling these issues.

I have a preference for starttls as informational or experimental but
am not currently sure how strong that preference is.

I do not think there is urgency to the kerberos 5.3 decision.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 28 Feb 2008 16:14:32 -0500

> am not currently sure how strong that preference is.

Why?

---

From: Sam Hartman <[email-masked]>
Date: Thu, 28 Feb 2008 16:35:39 -0500

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> --On Thursday, February 28, 2008 04:10:36 PM -0500 Sam
    Jeffrey> Hartman
    Jeffrey> <[email-masked]> wrote:

    >> I have a preference for starttls as informational or
    >> experimental but am not currently sure how strong that
    >> preference is.

    Jeffrey> Why?  _______________________________________________

Ah.  As I think about this question I realize I have a strong
objection to decoupling the status of starttls from the mandatory to
implement for 5.3.

I think that if starttls is not going to be the 5.3 mandatory to implement then:

* It should block on that mandatory to implement

* It should not be standards track.

Doing anything else seems like it would confuse things.

My preference would be to publish as info/exp now and move to standards track if we decide to make it the mandatory to implement.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg