Subject: [Ietf-krb-wg] Proposed text for recharter items --- RE: When to start discussing re-charter and new items

From: Thomas Hardjono <[email-masked]>
Date: Mon, 14 Mar 2011 09:50:13 -0400

Folks,

Seeing that the next IETF is just 2 weeks away, below are suggested text 
for the items I proposed for the re-charter.

I'm truly hoping that at the Prague IETF we can *finalize* the 
re-charter, and not postpone it. We have had since early November to 
talk about it on the mailing list. My understanding (as I have been told 
repeatedly) is that the KRB WG meetings at the IETF are to finalize 
stuff.

-----
The Working Group will:

[#1] Define an efficient WG process for the addition of new enc-types in 
Kerberos, and the introduction of new RFCs defining Kerberos support of 
new enc-types. Since Kerberos is a protocol that is deployed world-wide, 
there is a strong need for new enc-types to be efficiently added to and 
easily supported by Kerberos v5.

[#2] Produce one or more specifications/RFCs (standards-track) that 
defines a generalized Principal Authorization Data (PAD) structure for 
conveying authorization-related information.

[#3] Produce one or more specifications/RFCs (standards-track) that 
solves the cross-realm trust establishment issues in Kerberos V5 as 
identified in RFC5868. The solutions must support the multi-realm 
complex scenarios.
-----

/thomas/

___________________

> -----Original Message-----
> From: [email-masked] [mailto:ietf-krb-wg-
> [email-masked]] On Behalf Of Larry Zhu
> Sent: Tuesday, January 04, 2011 1:58 PM
> To: Jeffrey Hutzelman; Thomas Hardjono
> Cc: krb-wg mailing list ([email-masked])
> Subject: Re: [Ietf-krb-wg] When to start discussing re-charter and new
> items
>
> In IETF79, we got the feedback that the charter should be more
> specific. Though the specific items Thomas brought up are concrete by
> nature and there are already some rough proposals on the list (e.g.
> PKCROSS) based on prior discussions here.
>
> -----Original Message-----
> From: [email-masked] [mailto:ietf-krb-wg-
> [email-masked]] On Behalf Of Jeffrey Hutzelman
> Sent: Monday, January 03, 2011 10:15 AM
> To: Thomas Hardjono
> Cc: krb-wg mailing list ([email-masked]); [email-masked]
> Subject: Re: [Ietf-krb-wg] When to start discussing re-charter and new
> items
>
> On Mon, 2011-01-03 at 12:41 -0500, Thomas Hardjono wrote:
>
> > I was wondering when the Kerberos WG could start discussing items 
> > for
> > the re-charter. (It'd be good if we could finalize the updated
> charter
> > by the March IETF).
>
> You're welcome to bring up anything you'd like to see in the new
> charter on the mailing list.  I've been working on putting together a
> proposal for a new charter that I hoped to bring to the list last
> month, but I haven't had time to finish yet.  I'll probably have time
> to work on that next week.
>
> I agree I'd like to have the rechartering done by the end of March.
>
> > (c) One or more solutions/protocols to solve the cross-realm trust
> > establishment problem. [AFAIK, the current charter only allows for a
> > "problem statement" (RFC5868) but does not allow for the WG to work
> on
> > specific solutions/protocols].
>
> The present charter allows us to consider proposals, but does not
> contain any specific solutions and deliberately is not open-ended in
> this regard.
>
>
> Our original charter was fairly open-ended and contained some work
> items that we interpreted fairly broadly.  During the last recharter,
> we tried to be more focused and less wide-open.  Experience since then
> has convinced me that we may have gone too far in that direction, in
> some respects, so I'd like to see the new charter give us a fair bit 
> of
> leeway in adopting certain types of work.  Particularly, I expect to
> propose a charter that make it fairly easy for us to adopt enctype and
> "true" authorization data work, and perhaps some kinds of "true"
> preauth work, without requiring rechartering.  However, I don't expect
> to be open-ended in other regards, so if there are specific items 
> you'd
> like to see included, please bring those up on the list.
>
> -- Jeff
>
> _______________________________________________
> ietf-krb-wg mailing list
> [email-masked]
> https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
>
>
> _______________________________________________
> ietf-krb-wg mailing list
> [email-masked]
> https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 14 Mar 2011 11:18:06 -0400

> for the items I proposed for the re-charter.

Thanks; that's helpful.

> My understanding (as I have been told 

Not exactly.  The test I have generally used is that meeting time should
generally be used for discussion and not for presentation.  For that
reason I tend to reject requests for meeting time to present new
proposals that have not been discussed on the list or for someone to
just talk about the work they've been doing when there are no open
issues for the WG to discuss.

As with all IETF work, things are "finalized" on the mailing list,
usually through some explicit WGLC or other consensus call.  Decisions
made at meetings must be confirmed on the mailing list in some fashion;
however, often this takes the form of the eventual WGLC on a document
which has been modified to reflect the decision -- we normally have done
explicit consensus calls only on major or controversial issues or where
the chairs suspect there may be objection from individuals who were not
able to participate in the meeting.

In short, meetings are for _doing work_, particularly work requiring the
high-bandwidth discussion environment afforded by a face-to-face
meeting; they are not for _presentation_.  And, while decisions are
often made in meetings, that is not necessary.

That said, we usually do make some room for administrative matters, such
as a brief status update at the beginning of the meeting (I've been
trying to make these shorter, and would appreciate any feedback to that
effect, off-list).  We have also sometimes had a disucssion of
milestones at the end, but I've come to the conclusion that this is not
an effective use of everyone's time, and is better handled between the
chairs, AD, and individual document authors.

With regard specifically to charter updates:  I have received several
proposals for items to appear on an updated charter.  While I had hoped
to prepare a proposal some time ago, I haven't had a chance to finish
that.  However, I do expect to spend a solid block of time on IETF work
in the next day or two (in time to get a draft meeting agenda in by
Wednesday), and at that time I'll prepare a charter proposal and send it
to the mailing list.  I expect to include an agenda item for charter
discussion, but my hope is that any issues will have been discussed and
resolved on the mailing list by then.

Now would be a good time for others to send any proposed charter items
they haven't already sent me.  Text such as Thomas has included would be
helpful but is not necessary, and I don't promise to include any
specific text in my proposal.

Now would also be a good time to send any agenda items for the meeting
in Prague.

-- Jeff

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 14 Mar 2011 18:24:56 +0100

Jeffrey Hutzelman <[email-masked]> writes:

> they haven't already sent me.

I have asked earlier whether the WG is interested in the following
documents but the discussion was not conclusive.

http://tools.ietf.org/html/draft-josefsson-kerberos5-i18n-00

http://tools.ietf.org/html/draft-josefsson-krb5starttls-bootstrap-02

/Simon

---

From: Sam Hartman <[email-masked]>
Date: Tue, 15 Mar 2011 07:43:46 -0400

>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:

    Simon> http://tools.ietf.org/html/draft-josefsson-kerberos5-i18n-00
I support work on the problem described by this draft.  I don't have any
significant issues with the solution described by this draft.  I would
support adopting a work item for a standards-track solution to this
issue.  I would not support this particular solution as an informational
document, although if for some reason we couldn't agree to standardize a
solution I can think of small modifications I would support for
informational.

    Simon> http://tools.ietf.org/html/draft-josefsson-krb5starttls-bootstrap-02

I don't have any concerns with us taking on a document like this.
However based on starttls, you may get faster results through another channel.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tom Yu <[email-masked]>
Date: Wed, 16 Mar 2011 12:12:25 -0400

I'd like to add another proposed charter item:

    The Working Group will produce one or more specifications
    (standards-track) for the use of additional cryptographic
    algorithms in Kerberos using the RFC 3961 framework.  These
    algorithms must be of good quality, have broad international
    support, and fill a definite need.

Of course, I'm open to suggestions for changes to the text.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 16 Mar 2011 12:21:12 -0400

> Of course, I'm open to suggestions for changes to the text.

It's already in there:

* Prepare, review, and advance standards-track and informational
  specifications defining use of new cryptographic algorithms in the
  Kerberos protocol, on an ongoing basis.

I'm happy to add your last sentence and the RFC3961 reference:

* Prepare, review, and advance standards-track and informational
  specifications defining use of new cryptographic algorithms in
  Kerberos using the RFC3961 framework.  These algorithms must be
  of good quality, have broad international support, and fill a
  definite need.

I'm not convinced we don't want to define "national" algorithms, even if
they don't have "broad international support", but presumably in that
case they'd be informational.

I don't think we ever reached a conclusion regarding whether we want to
work on non-standards-track algorithms.

-- Jeff

---

From: Tom Yu <[email-masked]>
Date: Wed, 16 Mar 2011 13:43:32 -0400

>   Kerberos protocol, on an ongoing basis.

Sorry, I think I managed to miss it the first time around.

> work on non-standards-track algorithms.

In that case, I propose changing the last sentence to:

    Cryptographic algorithms intended for standards-track
    specifications of this kind must be of good quality, have broad
    international support, and fill a definite need.

That leaves open the possibility of specifying (as informational
documents) "national" algorithms that don't have "broad international
support".
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg