Subject: [Ietf-krb-wg] A new draft submission

From: "Russell J. Yount" <[email-masked]>
Date: Mon, 8 Nov 2010 10:28:51 -0500

Hello,

I would like to inform you of the submission of a new draft 

The Unencrypted Form Of Kerberos 5 KRB_CRED Message
<draft-yount-krb-cred-clear-text-00.txt>

The draft is accessible at 

http://www.ietf.org/id/draft-yount-krb-cred-clear-text-00.txt

The motivation for this work is to provide an IETF reference for the use of
an unencrypted KRB_CRED

in the OASIS SAML V2.0 Kerberos Attribute Profile authored by Josh Howlett
and over the long term the

addition of a standards based Kerberos ticket passing method to Internet2
Shibboleth web single sign on software.

-Russ

Russell J. Yount <[email-masked]>

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 8 Nov 2010 11:17:24 -0600

> http://www.ietf.org/id/draft-yount-krb-cred-clear-text-00.txt

I support this proposal.  Back when we were working on RFC4120 we
removed the null enctype, but I think it still has this one use.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Tue, 09 Nov 2010 20:18:09 -0500

I support this proposal.

A minor nit.  Your reference to RFC 4121 should be changed to a
reference to RFC 1964.  The unencrypted krb_cred is only used with DES
enctypes, which RFC 4121 has nothing to say about.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Stephen C Buckley <[email-masked]>
Date: Tue, 9 Nov 2010 20:32:41 -0500

On Nov 8, 2010, at 10:28 AM, "Russell J. Yount" [email-masked]<mailto:[email-masked]> wrote:

Hello,

The Unencrypted Form Of Kerberos 5 KRB_CRED Message <draft-yount-krb-cred-clear-text-00.txt>

The motivation for this work is to provide an IETF reference for the use of an unencrypted KRB_CRED
in the OASIS SAML V2.0 Kerberos Attribute Profile authored by Josh Howlett and over the long term the
addition of a standards based Kerberos ticket passing method to Internet2 Shibboleth web single sign on software.

I support this proposal, as well.

s

---

From: Thomas Hardjono <[email-masked]>
Date: Wed, 10 Nov 2010 10:37:09 -0500

Folks,

I support this work by Russ and JHutz.

(PS. This draft is related to the SAML-Kerberos work being done in 
OASIS).

/thomas/

_________________

-From: [email-masked] 
[mailto:[email-masked]] On Behalf Of Russell J. Yount
Sent: Monday, November 08, 2010 10:29 AM
To: [email-masked]
Cc: 'Josh Howlett'; 'Jeffrey Hutzelman'
Subject: [Ietf-krb-wg] A new draft submission

Hello,

The motivation for this work is to provide an IETF reference for the use 
of an unencrypted KRB_CRED
in the OASIS SAML V2.0 Kerberos Attribute Profile authored by Josh 
Howlett and over the long term the
addition of a standards based Kerberos ticket passing method to 
Internet2 Shibboleth web single sign on software.

-Russ

---

From: Greg Hudson <[email-masked]>
Date: Wed, 10 Nov 2010 11:05:15 -0500

I support this work.  I found just a couple of editorial issues.  First:

   The unencrypted form of the KRB_CRED has the EncryptedData as defined
   in Section 5.2.9 [RFC4120] MUST BE specified with the encryption type
   (etype) of 0.

This sentence is not grammatical ("The X has the Y MUST BE Z").

Second, you use KRB_CRED most of the time and KRB-CRED once.  In this
respect, you are consistent with RFC 4120 (in that RFC 4120 is equally
inconsistent).  I know Tom has brought this up before in a more general
context and I don't remember the outcome (which may have been a lack of
consensus).  I would suggest using KRB-CRED everywhere under the theory
that KRB-CRED is the ASN.1 structure and KRB_CRED is the message type
number, but it's not a strong opinion.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 10 Nov 2010 11:25:23 -0500

"Greg Hudson" <[email-masked]> wrote:

>inconsistent).

That's what we were going for. :-)

---

From: Sam Hartman <[email-masked]>
Date: Wed, 10 Nov 2010 18:57:10 -0500

>>>>> "Greg" == Greg Hudson <[email-masked]> writes:

    Greg> Second, you use KRB_CRED most of the time and KRB-CRED once.
    Greg> In this respect, you are consistent with RFC 4120 (in that RFC
    Greg> 4120 is equally inconsistent).  I know Tom has brought this up
    Greg> before in a more general context and I don't remember the
    Greg> outcome (which may have been a lack of consensus).  I would
    Greg> suggest using KRB-CRED everywhere under the theory that
    Greg> KRB-CRED is the ASN.1 structure and KRB_CRED is the message
    Greg> type number, but it's not a strong opinion.

While editing RFC 4120, I tried to use krb_cred while referring to the
message and krb-cred while referring to the ASN.1 type.  Tom apparently
was using a different style, and I think Cliff possibly a third.
your punctuation may very.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg