Subject: [Ietf-krb-wg] Last Call: RFC6112: Indicating support for anonymous PKINIT

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 09 Mar 2011 11:47:38 -0500

Sam has proposed adopting the following change to RFC-to-be 6112, adding
a requirement for KDCs to specifically indicate support of anonymous
PKINIT:

OLD:

   A KDC that supports anonymous PKINIT MUST indicate the support of
   PKINIT, according to Section 3.4 of [RFC4556].

NEW:

   A KDC that supports anonymous PKINIT MUST indicate the support of
   PKINIT, according to Section 3.4 of [RFC4556]. In addition, such a
   KDC MUST indicate support for anonymous PKINIT by including a
   padata element of padata-type PA_PKINIT_KX and empty padata-value
   when including PA-PK-AS-REQ in an error reply.

   When included in a KDC error, PA_PKINIT_KX indicates support for
   anonymous PKINIT. As discussed in section 7, when included in an
   AS-REP, PA_PKINIT_KX proves that the KDC and client both
   contributed to the session key for any use of Diffie-Hellman key
   agreement with PKINIT.

This message serves to start a Working Group Last Call on this specific
change.  Due to the timing of the upcoming IETF meeting, this will be a
three-week last call, to end on March 30, 2011, at 23:59 US/Eastern time
(this is early Thursday morning in Prague).  Please send any comments,
support, or objections before that time.

Because this is a post-IETF-Last-Call document, adopting this change
will require some positive indication of support; lack of objection is
not sufficient.  Provided a consensus appears, I will ask our ADs to
approve sending this change to the RFC-Editor.

-- Jeff

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Wed, 09 Mar 2011 09:50:09 -0800

9 mar 2011 kl. 08.47 skrev Jeffrey Hutzelman:

> support

yes

Love

---

From: "Henry B. Hotz" <[email-masked]>
Date: Wed, 9 Mar 2011 10:24:05 -0800

+1

On Mar 9, 2011, at 9:50 AM, Love Hörnquist Åstrand wrote:

> <smime.p7s>_______________________________________________
> ietf-krb-wg mailing list

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: Greg Hudson <[email-masked]>
Date: Wed, 09 Mar 2011 15:09:19 -0500

I support this change.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 31 Mar 2011 09:29:24 +0200

> approve sending this change to the RFC-Editor.

This last call ended earlier this morning.  I've seen several messages
of support, and heard some others during this week.  I've seen no
objections.  So, Sam and I will work with our ADs and the RFC-Editor to
get this change into the document.

-- Jeff