Subject: Re: [Ietf-krb-wg] Last Call: RFC6112: Indicating support for anonymous PKINIT

From: Stephen Farrell <[email-masked]>
Date: Wed, 06 Apr 2011 11:58:31 +0100

Hi,

As AD, I plan to approve this change in the next day or so unless
someone yells.

Regards,
Stephen.

On 31/03/11 08:29, Jeffrey Hutzelman wrote:
> On Wed, 2011-03-09 at 11:47 -0500, Jeffrey Hutzelman wrote:
>> Sam has proposed adopting the following change to RFC-to-be 6112, adding
>> a requirement for KDCs to specifically indicate support of anonymous
>> PKINIT:
>>
>> OLD:
>>
>>    A KDC that supports anonymous PKINIT MUST indicate the support of
>>    PKINIT, according to Section 3.4 of [RFC4556].
>>
>> NEW:
>>
>>    A KDC that supports anonymous PKINIT MUST indicate the support of
>>    PKINIT, according to Section 3.4 of [RFC4556]. In addition, such a
>>    KDC MUST indicate support for anonymous PKINIT by including a
>>    padata element of padata-type PA_PKINIT_KX and empty padata-value
>>    when including PA-PK-AS-REQ in an error reply.
>>
>>    When included in a KDC error, PA_PKINIT_KX indicates support for
>>    anonymous PKINIT. As discussed in section 7, when included in an
>>    AS-REP, PA_PKINIT_KX proves that the KDC and client both
>>    contributed to the session key for any use of Diffie-Hellman key
>>    agreement with PKINIT.
>>
>>
>> This message serves to start a Working Group Last Call on this specific
>> change.  Due to the timing of the upcoming IETF meeting, this will be a
>> three-week last call, to end on March 30, 2011, at 23:59 US/Eastern time
>> (this is early Thursday morning in Prague).  Please send any comments,
>> support, or objections before that time.
>>
>> Because this is a post-IETF-Last-Call document, adopting this change
>> will require some positive indication of support; lack of objection is
>> not sufficient.  Provided a consensus appears, I will ask our ADs to
>> approve sending this change to the RFC-Editor.
> 
> 
> This last call ended earlier this morning.  I've seen several messages
> of support, and heard some others during this week.  I've seen no
> objections.  So, Sam and I will work with our ADs and the RFC-Editor to
> get this change into the document.
> 
> -- Jeff
> 
> 
> _______________________________________________
> ietf-krb-wg mailing list
> [email-masked]
> https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
> 
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg