Subject: [Ietf-krb-wg] draft-josefsson-krb5starttls-bootstrap-02

From: Simon Josefsson <[email-masked]>
Date: Fri, 06 Mar 2009 15:34:43 +0100

All,

I have updated the krb5starttls-bootstrap document, see announcement
below.  It specifies a new PA-TLS pre-auth type.

I think it would be useful to ask the WG whether it wants to adopt the
content of this document.  There were discussions around adding some of
the material in this document to the core krb5starttls document.  That
seems like a good idea only if there is consensus around adopting the
content.

Btw, I noticed that the core krb5starttls protocol is not mentioned on
the WG web page, although it is explicitly mentioned in the WG charter.
Is that an oversight?

/Simon

[email-masked] writes:

> 	Title           : Deriving Keys From TLS for Kerberos V5
> 	Author(s)       : S. Josefsson
> 	Filename        : draft-josefsson-krb5starttls-bootstrap-02.txt
> 	Pages           : 9
> 	Date            : 2009-03-06
>
> This document describes how clients can use the Kerberos V5 over TLS
> protocol together with its long term key to 1) avoid having to
> validate the server certificate, 2) securely learn a KDC's server
> certificate, and 3) learn the trust anchors used by the KDC.
>
> We also describe how the Kerberos V5 over TLS protocol can be used to
> 4) avoid the need for a long term shared key between the client and
> the KDC by instead using TLS client authentication.
>
> These goals are achieved by introducing a new Kerberos V5 pre-
> authentication type that modify how the Kerberos V5 reply key is
> derived.
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-josefsson-krb5starttls-bootstrap-02.txt
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 11 Mar 2009 17:53:46 -0400

> seems like a good idea only if there is consensus around adopting the

This is a bit fuzzy; generally we adopt documents, not content.  If we have 
consensus to add one of the features to the core document, we can do so, we 
don't need to first establish consensus to "adopt" the feature.

That said, I think we do need to reach a conclusion on whether and how much 
of this functionality we want in the core starttls document, and on whether 
and how much of the rest we wish to adopt as a separate WG document. 
Depending on the answer to that, we may actually be ready (again) to start 
a WGLC on the core starttls document.

I would be very interested in hearing from the working group on these 
questions _before_ the IETF meeting, so we have a good basis for discussion 
on where to go next.

> the WG web page, although it is explicitly mentioned in the WG charter.

Yes, this is an oversight which I will get corrected.

-- Jeff

---

From: Sam Hartman <[email-masked]>
Date: Thu, 12 Mar 2009 13:10:28 -0400

I definitely want to encourage work similar to starttls-bootstrap.  I
have not read the document and will not get to it until late next week
at the earliest.

I don't know whether adopting the work will serve to encourage it:
starttls itself has been slowed down by the WG process.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 16 Mar 2009 14:45:54 +0100

Jeffrey Hutzelman <[email-masked]> writes:

> This is a bit fuzzy; generally we adopt documents, not content.  If we
> have consensus to add one of the features to the core document, we can
> do so, we don't need to first establish consensus to "adopt" the
> feature.
>
> That said, I think we do need to reach a conclusion on whether and how
> much of this functionality we want in the core starttls document, and
> on whether and how much of the rest we wish to adopt as a separate WG
> document. Depending on the answer to that, we may actually be ready
> (again) to start a WGLC on the core starttls document.
>
> questions _before_ the IETF meeting, so we have a good basis for
> discussion on where to go next.

I believe the core krb5starttls document is done, possibly with the
exception of the new section on server certificate validation.

I see no added value in holding up the core document to add new
features.

I see some limited value in having the documents separate: it is
possible to use krb5starttls without making use of any of the features
described in krb5starttls-bootstrap.

Of course, it is possible to merge the documents.  Given the above, I
would prefer that we don't merge them unless there are compelling
reasons.  I don't see any such reasons yet.

> Yes, this is an oversight which I will get corrected.

Thanks.

/Simon