Subject: [Ietf-krb-wg] FW: New Version Notification for draft-ietf-krb-wg-otp-preauth-06

From: [email-masked]
Date: Thu, 4 Sep 2008 05:30:00 -0400

I have just submitted a new version of the OTP pre-auth ID that should
hopefully address the issues raised during the recent review.

There are still some outstanding issues that came up:

1. Larry questioned whether section 2.1 in the document is required.

   As described above, this document describes a generic system for
   supporting different OTP mechanisms in Kerberos pre-authentication.
   However, to ensure interoperability, all implementations of this
   specification SHOULD provide a mechanism for OTP mechanism support to
   be added or removed.

This text was added following a discussion in the WG on an earlier
version of the draft.  Does the WG still think that this text is
required?

2. Srinivas Cheruku of CyberSafe asked how the client should abort the
authentication exchange if the final confirmation of the reply key
change fails.  

Is there a standard way of doing this or does this need to be specified
as part of the pre-auth framework?

3. Srini also suggested that it might be worth changing the
PA-OTP-CHALLENGE sent by the KDC to the client so that it has a sequence
of supported encryption types that the client may use to encrypt the
response rather than including a single etype.  This would allow the
client to select the first encryption type that it supports.

Does the group think that this change should be made?

4. I have changed the IANA Considerations to the following:

   A registry will be required for the URIs to be used as otp-algID
   values as introduced in Section 4.1.  It is currently anticipated
   that the registry being introduced in section 8.4 of [HoPeMa08] can
   be used for this purpose and no other IANA actions are anticipated.

Is it acceptable for the ID to depend on a draft in another WG in this
way?

Thanks

--Gareth

-----Original Message-----
From: IETF I-D Submission Tool [mailto:[email-masked]] 
Sent: 04 September 2008 10:10
To: Richards, Gareth
Subject: New Version Notification for draft-ietf-krb-wg-otp-preauth-06 

A new version of I-D, draft-ietf-krb-wg-otp-preauth-06.txt has been
successfuly submitted by Gareth Richards and posted to the IETF
repository.

Filename:	 draft-ietf-krb-wg-otp-preauth
Revision:	 06
Title:		 OTP Pre-authentication
Creation_date:	 2008-09-04
WG ID:		 krb-wg
Number_of_pages: 35

Abstract:
The Kerberos protocol provides a framework authenticating a client using
the exchange of pre-authentication data.  This document describes the
use of this framework to carry out One Time Password
(OTP) authentication.

The IETF Secretariat.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 04 Sep 2008 11:17:18 -0400

> Is it acceptable for the ID to depend on a draft in another WG in this

At this stage, yes.  When all is said and done and everything is published, 
you will want one document to define the registry and the other to refer to 
it (i.e. you need to say "use the values defined in such-and-such 
registry").  This is not necessarily a normative reference, since you'll be 
referring to the registry and not to the document that creates it, but it 
has the same effect on publication schedule, since you can't really publish 
before the registry exists.  Thus, if one document will take significantly 
longer to complete than the other (and the registry is the only 
interdependency), then you want the registry defined in the document that 
will be completed first.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: "Henry B. Hotz" <[email-masked]>
Date: Thu, 4 Sep 2008 11:47:40 -0700

> as part of the pre-auth framework?

Is an explicit action needed, or can you just "walk away"?  (If you  
can't just "walk away" is there a security issue that needs addressing?)

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: [email-masked]
Date: Fri, 5 Sep 2008 04:11:14 -0400

> > Is there a standard way of doing this or does this need to be 
> > specified as part of the pre-auth framework?
> 
> Is an explicit action needed, or can you just "walk away"?  
> (If you can't just "walk away" is there a security issue that 
> needs addressing?)
> 

There is no security issue that I can think of.  It is just not totally
clear what the client should do if the client fails to verify that the
reply key has been updated correctly by the KDC.  (See section 4.3 of
draft-ietf-krb-wg-preauth-framework-08.)  Srinivas was asking for
clarification of what should be done.  From what you say, it can simply
terminate the exchange.

--Gareth