Subject: [Ietf-krb-wg] FW: New Version Notification for draft-ietf-krb-wg-otp-preauth-03

From: "Richards, Gareth" <[email-masked]>
Date: Thu, 14 Feb 2008 14:32:26 -0000

I have just submitted an updated to the OTP pre-authentication ID that
should hopefully cover the issues discussed a couple of weeks ago.

1. Extended several sections to contain more detail on how various
attributes are set in the PA-OTP-REQUEST and PA-OTP-CHALLENGE

2. Corrected the error where etypes and otp-length were INETGERS rather
than INT32

3. Changed the sname used in the hash algorithm in section 3.6 to be the
UTF8 encoded FQDN of the KDC.  If the DN is an IDN then the output of
nameprep as described in RFC3490

4. Added informational references to RFC2808 and RFC4226 as examples of
OTP mechanisms that the system supports and made RFC2289 as mandatory to
implement.

5. Clarified the use of the "initial" flag in the PIN change process in
section 2.3

6. Added example exchanges in a new Appendix B.

I have also added a new "combine" flag following a discussion off list
that controls whether the challenge in a challenge response OTP is
combined with the current token state.  This brings the OTP mechanism in
line with the POTP EAP OTP mechanism in RFC4793.

--Gareth

-----Original Message-----
From: IETF I-D Submission Tool [mailto:[email-masked]] 
Sent: 14 February 2008 14:24
To: Richards, Gareth
Subject: New Version Notification for draft-ietf-krb-wg-otp-preauth-03 

A new version of I-D, draft-ietf-krb-wg-otp-preauth-03.txt has been
successfuly submitted by Gareth Richards and posted to the IETF
repository.

Filename:	 draft-ietf-krb-wg-otp-preauth
Revision:	 03
Title:		 OTP Pre-authentication
Creation_date:	 2008-02-14
WG ID:		 krb-wg
Number_of_pages: 33

Abstract:
The Kerberos protocol provides a framework authenticating a client using
the exchange of pre-authentication data.  This document describes the
use of this framework to carry out One Time Password
(OTP) authentication.

The IETF Secretariat.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 27 Feb 2008 15:12:37 -0500

> line with the POTP EAP OTP mechanism in RFC4793.

Is this done (ready for WGLC), or are there still changes needed?
Is there enough information to actually implement RFC2289?

Will you be at IETF71 in Philadelphia?
If there are open issues, we should spend time on them there.

-- Jeff

---

From: [email-masked]
Date: Thu, 28 Feb 2008 14:20:59 -0000

Jeff,

> Is this done (ready for WGLC), or are there still changes needed?
I think that I have addressed all the issues raised by the WG and there
are no other changes planned.

> Is there enough information to actually implement RFC2289?
Yes, but see below.

> Will you be at IETF71 in Philadelphia?
I will be there.

> If there are open issues, we should spend time on them there.
One potential issue is whether it is really necessary to have a
mandatory to implement mechanism since this ID is a general framework
that can support different mechanisms (in the same manner as RFC4793).
I was intending to leave the details of particular mechanism to
profiles.   If the IESG require this and RFC2289 is MTI then there may
be a need to have include a profile in the ID for RFC2289.  If this is
being made MTI for interoperability then I suppose it will require a
specification of exactly how it should be implemented.

--Gareth

---

From: "Henry B. Hotz" <[email-masked]>
Date: Thu, 28 Feb 2008 09:18:07 -0800

> specification of exactly how it should be implemented.

I think the specification is stronger, and more likely to be adopted,  
if it includes a MTI mechanism with everything you need to make it  
work, as well as everything you need to add new mechanisms.

That said, I have no objection to a pure framework document as long  
as the introduction, etc. properly reflect that.  I think the  
liklihood of the RFC being adopted and deployed goes down though.

------------------------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: "Tim Alsop" <[email-masked]>
Date: Thu, 28 Feb 2008 18:15:14 -0000

Henry,

------

------

My view is that there is NO NEED to have a mandatory to implement
mechanism in this RFC.

Anyway, we plan to start coding soon, and implement this OTP PreAuth
framework in a new version of our TrustBroker Security Server and
TrustBroker Secure Client products. Our products are not based on MIT
code, but we implement Kerberos protocol and associated RFCs/drafts.

Thanks,
Tim

---

From: "Henry B. Hotz" <[email-masked]>
Date: Thu, 28 Feb 2008 10:32:07 -0800

I would vote for it either way as long as it's consistent.