Subject: [Ietf-krb-wg] KRB-WG summary for IETF 77

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 25 Mar 2010 11:19:49 -0700

Kerberos Working Group - IETF77 meeting summary

DECISIONS (to be validated):
  - Principals in the KDC data model may have multiple names, each of
    which has an associated realm name.

  - Update KDC data model to reflect not all implementations need
    a canonical principal name for salting

ACTION ITEMS:
  - JH, TP: Resolve DISCUSS issues on STARTTLS
  - LZ: Submit new naming, anon, IAKERB
  - Chairs: Start WGLC on DES die die die
  - Chairs: Start WGLC on DHCPv6 Option
  - LZ: Finish review of OTP
  - Chairs: adopt draft-lha-krb-wg-some-numbers-to-iana-00
  - Chairs, AD: Update milestones

SESSION SUMMARY:

* Reviewed the status of several documents:
  - Cross-realm Problem Statement is now in the RFC Editor Queue
  - Chairs, Authors, AD are working on resolving DISCUSSes on STARTTLS
  - Preauth framework is on the 4/8 IESG telechat agenda
  - Anonymous needs another update to reflect WG discussion and update
    numbers, then get another IETF LC.  Naming needs to be unexpired.
    Then both go back to the IESG.
  - IAKERB is in PROTO eval, but needs to be unexpired.

* The KDC Data Model document is in its fourth and hopefully final WGLC.
  Three issues were discussed during the meeting:
  - Whether the realm name attribute should be single- or multi-valued
  - Updating to reflect that not all implementations need the concept
    of a canonical principal name to use in generating salted keys.
  - Greg Hudson's concern about the document's lack of clarity in its
    justification of separating keysets from other principal data for
    security reasons.

* The chairs noted several recently-adopted documents:
  - There was agreement at some previous meetings that the WG wishes to
    adopt the DHCPv6 option document.  The chairs and AD determined this
    was possible within the scope of the current charter, and so the
    document has now been adopted.  In the meantime, it has gone through
    several revisions as a result of WG feedback, and so will enter WGLC
    shortly.
  - Love's DES deprecation document was adopted based on WG consesus as
    expressed at various points in person and on the list.  There was a
    general sense in the room that this document is ready for WGLC, which
    will therefore begin shortly.  There was also strong consensus in the
    room that the document filename should remain
    "draft-lha-des-die-die-die", which succinctly captures its intent.
  - Love's ticket extensions document was adopted by WG consensus at a
    previous meeting and on the list.  However, it is currently on the
    back burner as the author handles more urgent work.

* There was discussion as to whether to adopt Love's IANA considerations
  document.  Sam Hartman in particular was concerned that adopting this
  document not create a presumption of consensus on its specific contents,
  particularly with regard to registration procedures.  Both Love and the
  chairs asserted this would not be the case, and there was general
  agreement to adopt the work.  WG discussion will be needed to determine
  appropriate registration procedures for each registry.

* There was some discussion as to whether there was sufficient interest
  to pursue creation of an LDAP schema document based on the KDC data model
  document now in WGLC.  The existing charter item is for a schema "for
  management of [information needed by the KDC]", but there maya also be
  some interest in a KDC storage backend schema.  Howard Chu and Simo Sorce
  have been working on a document which describes the latter, based on the
  information model.  It was suggested they submit their document as an
  individual submission and bring it up on the WG mailing list, at which
  point there could be a discussion as to whether it might be adopted and
  modified to fulfill the WG charter item.

* Thomas Hardjono gave a brief overview of a recent document describing
  a family of enctypes based on the Camellia cipher.  There was some
  discussion of this document.  Sam suggested that in deciding whether to
  adopt enctype work, the WG should take on only enctypes which it intends
  for the standards track.  It was also noted that if this work were to be
  adopted, the WG would determine which modes to include, and if the
  authors wished to define additional modes, they could do so in an
  individual informational document, with enctype number assignment subject
  to review by the designated expert (currently Ken Raeburn) as specified
  in RFC3961.

  There seemed to be a strong sense in the room that this work should be
  adopted; however, that poll was taken before discussion of IPR issues
  related to the Camellia cipher.  As a result, and because the IPR
  disclosure and licensing terms had been submitted but were not yet
  available via the IETF's IPR disclosure web site, it was agreed that the
  poll was not meaningful.  Further discussion will continue on the mailing
  list once the IPR disclosure becomes available.

* Henry Hotz gave a brief presentation on his work to document KX509.  Due
  to delays in getting his employer to authorize release of the document,
  an internet-draft is not yet available but will be soon.  There was some
  discussion of the work, and while no formal poll was taken, there seemed
  to be agreement this should happen within the security area of the IETF.
  It is not yet clear exactly where the work will find a home; this will
  be worked out between the authors, ADs, and chairs of related WG's.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Altman <[email-masked]>
Date: Thu, 25 Mar 2010 18:26:09 -0400

>  be worked out between the authors, ADs, and chairs of related WG's.

As an implementer of KX.509, I would be very happy to see a new KX509
protocol developed within the IETF.  However, the existing protocol has
some significant issues that in my opinion should prevent it from being
standardized.

I would be happy to work with Hank to write an informational RFC to
document the existing protocol, the variations that have been
implemented at various sites that have deployed it, and the issues
that should be addressed in any future specification.

Jeffrey Altman
Secure Endpoints, Inc.

---

From: "Henry B. Hotz" <[email-masked]>
Date: Thu, 25 Mar 2010 19:15:53 -0700

> that should be addressed in any future specification.

I've written up the existing protocol as a starting point.  I wanted to postpone discussions of protocol updates until I got the initial draft released, but I seem to be getting a consensus for a protocol update developing already.  (I don't disagree BTW.)

I expect to get proper clearance for the draft next week.  If I don't, I may ask you to be a co-author for that reason.  I do have clearance now for public release outside of the IETF with a Caltech copyright.  I'll send you a copy, and I can directly send anyone else who wants an early copy as well.  Just email me off-list.

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: Thomas Hardjono <[email-masked]>
Date: Mon, 29 Mar 2010 11:18:20 -0400

> -----Original Message-----
> From: [email-masked] [mailto:ietf-krb-wg-
> [email-masked]] On Behalf Of Jeffrey Hutzelman
> Sent: Thursday, March 25, 2010 2:20 PM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]
> Subject: [Ietf-krb-wg] KRB-WG summary for IETF 77
> 

Jeff,

As I explained at the start of the Camellia discussion, NTT had already attempted to upload the IPR Disclosure doc but without success.  I subsequently emailed the PDF IPR Disclosure doc prior to the WG meeting to the Area Directors and the Kerberos WG chairs.  Indeed, Tim Polk who was sitting next to me verified verbally that he received the IPR PDF file.

So, I think your assessment that "the poll was not meaningful" is too strong. Everyone in the room was aware that previous IPR Disclosures existed for Camellia for the IPsec WG and the TLS WG, and that another had been submitted for the Kerberos WG.

Here is the Kerberos-specific IPR Disclosure (dated 19 March 2010):

https://datatracker.ietf.org/ipr/1304/

Here is the other IPR Disclosures from NTT:

https://datatracker.ietf.org/ipr/search/?option=patent_search&patent_search=Nippon

Hope this clarifies.

/thomas/