Subject: [Ietf-krb-wg] Kerberos WG IETF71 meeting summary

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 13 Mar 2008 13:37:28 -0400

This is a SUMMARY of the Kerberos WG meeting held this week in Philadelphia 
as part of the 71st IETF meeting.  Full minutes will be posted on a later 
date.

-- Jeff

Kerberos Working Group - IETF 71 meeting summary

ACTION ITEMS:
* Nicolas Williams - send an updated version of set-change password
* Chairs - finish review and writeup of cross-realm problem statement
* Larry Zhu - prepare an example for naming of how unintended access
  could be granted if authentication succeedes with an unsupported
  well-known name.
* Chairs - ask folks commenting that the data model might be incomplete
  to come up with specific examples of things that are missing.
* Larry Zhu, Shawn Emery, others - examine the data model with respect
  to their specific implementations.

DECISIONS (to be validated):
* The data model document should not cover operations.
* OTP perhaps does not need a mandatory-to-implement mechanism

SESSION SUMMARY:

We reviewed the status of several documents that are working their way
through the queue, and discussed several documents which have recently
concluded IETF or Working Group Last Call.  The set-change password
document is waiting for an updated version which the author didn't quite
get in before the meeting, and then it will go to Tim and the IESG.

We reviewed the status of several documents that are working their way
through the queue.  The set-change password document is waiting for an
updated version which the author didn't quite get in before the meeting,
and then it will go to Tim and the IESG.  The cross-realm problem statement
document finished WG last call some time ago, and has been waiting for
the chairs to finish their review and writeup.

We also discussed several documents which have recently concluded IETF or
Working Group Last Call.  The PKINIT ECC document has received no notable
comments in IETF LC, and hopefully will move along smoothly.  There were
some comments in a security directorate review of naming, which will be
addressed in an upcoming revision.  The data model document just finished
WGLC.  Leif will do some updates to reflect comments received.

Sam Hartman reviewed recent updates to the Preauth Framework document,

Gareth Richards went over some open issues related to the OTP document.
There was discussion as to whether it was necessary to have a particular
mandatory-to-implement OTP mechanism; the conclusion in the room seemed
to be that it was not.  Gareth also described an issue relating to the
need to come up with OTP algorithm identifiers: apparently keyprov has
the same problem, and a joint solution may be appropriate.

The chairs would like to see the group consider possible directions and
next steps now that the cross-realm problem statement document is done.
This could include rechartering to pick up new work to address one or
more of the problems described there.  To that end, Kamada Ken'ichi gave
a presentation on the Client-Friendly Cross Realm work he's been doing.
We will continue to consider where to go next, and possibly have another
presentation in Dublin.  Interested parties should contact the chairs
and/or bring up their proposals on the mailing list.

There was a discussion relating to the intended status of the STARTTLS
document.  Before we send this document to the IESG, the chairs would
like to see us come to conclusion on whether it should be Informational
or Standards Track.  Tim is investigating whether there is precedent for
possible actions when the technical aspects of a document are complete
and it is blocked only on intended status.

At the open mic, Shoichi Sakane mentioned a proposal he is bringing to
the dhc working group to create a DHCPv6 option for identifying a KDC.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Shoichi Sakane <[email-masked]>
Date: Fri, 14 Mar 2008 06:52:00 +0900

Hi Jeff,

Thank you for quick summarizing.  Text is always very helpful for me.

> and/or bring up their proposals on the mailing list.

Client's performance is the most interesting item for me.  The client-friendly
cross realm work is possible solution of it.  I would like to make this work
to be the WG item if rechartering is needed.

And I think that resuming PK-CROSS is necessary in relation to this work.
I should have to be an editor if no one had any objection.

-- 
Shoichi Sakane
Yokogawa Electric Corporation

---

From: Larry Zhu <[email-masked]>
Date: Thu, 13 Mar 2008 21:22:04 -0700

Sanity check: why does the client need to talk with different realms?

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Shoichi Sakane
Sent: Thursday, March 13, 2008 2:52 PM
To: Jeffrey Hutzelman
Cc: [email-masked]
Subject: Re: [Ietf-krb-wg] Kerberos WG IETF71 meeting summary

Hi Jeff,

---

From: Shoichi Sakane <[email-masked]>
Date: Fri, 14 Mar 2008 17:03:08 +0900

Hi Larry,

Briefly, several contractors and several administrators work in a plant.
Even if there are devices in geographically same place, each device does
not necessarily belong to same administrative domain.  But these devices
occasionally communicate with each other to exchange information.
That is typical reason.

I have to be away from my keyboard due to returning home today.  If the
reason is not enough to convince you, I will try to describe more information.
Before that, could you tell me your concern or your point about your question ?

Shoichi Sakane