Subject: [Ietf-krb-wg] Last Call: <draft-ietf-krb-wg-otp-preauth-18.txt> (OTP Pre-authentication) to Proposed Standard

From: The IESG <[email-masked]>
Date: Mon, 15 Aug 2011 07:52:20 -0700

The IESG has received a request from the Kerberos WG (krb-wg) to consider
the following document:
- 'OTP Pre-authentication'
  <draft-ietf-krb-wg-otp-preauth-18.txt> as a Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
[email-masked] mailing lists by 2011-08-29. Exceptionally, comments may be
sent to [email-masked] instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract

   The Kerberos protocol provides a framework authenticating a client
   using the exchange of pre-authentication data.  This document
   describes the use of this framework to carry out One Time Password
   (OTP) authentication.

The file can be obtained via
http://datatracker.ietf.org/doc/draft-ietf-krb-wg-otp-preauth/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-krb-wg-otp-preauth/

No IPR declarations have been submitted directly on this I-D.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Mon, 15 Aug 2011 19:46:41 -0400

Hi.
Just around the time  that this document was sent to the IESG, a
discussion started surrounding the nonce text in this draft in the
Kerberos working group.
All the participants seemed to agree that the discussion was
non-blocking: if consensus on a change was not found before ietf last
call  ended, then the existing text would stand.
So, I did not ask our AD to block the draft.

However, the Kerberos working group did reach a consensus on new text.
We'd like to propose to the IETF that

The text in section 4.1 is changed from:
        
        This nonce string MUST be as long as the longest key length of
        the symmetric key types that the KDC supports and MUST be chosen
        randomly.

to

        This nonce string MUST contain a randomly chosen component at
        least as long as the armor key length.

The KDC can then compose a nonce out of a random component and a
timestamp.

This change has already reached consensus within the working group. If
there are no objections (especially including objections from our AD)
I'll ask the authors to make this change. If there are objections then
our AD will judge consensus as usual.

Sam hartman
Kerberos Co-chair

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 16 Aug 2011 00:54:53 +0100

Hi Sam,

No problem here. Seems sensible either way to me and a little
better with the new text if that's what the WG prefer. I'd say
make the change when processing any other IETF LC comments.

S.