Subject: [Ietf-krb-wg] Preliminary minutes of the call on the general-pac draft

From: Sam Hartman <[email-masked]>
Date: Thu, 16 Feb 2012 10:23:04 -0500

Yesterday we had a call on the pad and cammac (formerly general-pac)
drafts.
Nalin Dahyabhai  jumped in and took notes; these were greatly
appreciated.

If there are no corrections we'll send these in in a couple of weeks
after I return from vacation.

Attending:
  Greg Hudson
  Sam Hartman
  Jeffrey Hutzelman
  Simo Sorce
  Nico Williams
  Stephen Farrell
  Tom Yu
  Nalin Dahyabhai
  Thomas Hardjono
  Zhanna Tsitkova

Sam: this is an IETF meeting, subject to IETF property rules
  Participants should read / be familiar with
  http://www.ietf.org/about/note-well.html

Agenda refresher:
  1. purpose of the PAD and CAMMAC drafts (scoping)
  2. where it will fit(?) & quick review of how authdata works in general
  3. is this 1 draft or 2
  4. how about other types of data in authdata
  5. type number registration procedures
  have received an offline request to discuss CAMMAC before PAD

1. Purpose of the PAD and CAMMAC drafts (scoping)
 - Consensus on call is that the purpose of the PAD draft is to provide
   authorization attributes in support of authorization and account
   provisioning for access to application services on POSIX systems.
 - Consensus on call is that the primary purpose of the CAMMAC draft is
   to replace KDCIssued.

2. Where it will fit(?) & quick review of how authdata works in general
 - Agenda item 2 deemed not necessary.

3. Is this one draft or two?
 - Consensus is in favor of the split of the PAD and CAMMAC drafts.

4. Open issues on the CAMMAC draft:
 - Consensus is that public key signature (pubkey-signature) need not be
   specified at this time.
 - Consensus is that being able to add new types of authentication to
   the structure is worth discussion.
 - Discussion of the session id / AD-ID-ANCHOR will be moved to the
   list.
 - Partial list of concerns (discussion will move to list)
  - KDCissued uses the session key of the ticket, but the draft uses the
    service's long-term key
  - CAMMAC includes Checksum elements, but doesn't include kvno or
    enctype, which are probably needed.

4. Open issues on the PAD draft:
 - Containing arbitrary SAML attributes in a PAD is out of scope for
   this work, but specifying SAML authz data is in-scope for the WG.
 - Consensus is that the short name field will only be used to specify a
   string which can be combined with other identifiers to make them
   unique if they are not otherwise, validation discussion will be moved
   to the list.
 - Issue of central home directories and PAD-Posix-Homedir will be taken
   to the list.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Thu, 16 Feb 2012 10:28:40 -0500

folks, we made a number of consensus calls at the call yesterday as
described in the preliminary minutes.
This message serves to ask for a confirmation of these calls on the list
per RFC 2418.
If there are no objections within the next two weeks these calls will
all stand.

--Sam

---

From: Nico Williams <[email-masked]>
Date: Thu, 16 Feb 2012 20:46:51 -0600

>   the structure is worth discussion.

In light of the discussion of federation today I would say that: a)
public key signatures are likely to be eventually needed, b) if so
perhaps best obtained by reusing SAML, c) nonetheless we should ensure
that CAMMAC is extensible enough w.r.t. new signatures or MACs.

Also, I've a question about the GSS-EAP use of SAML: are signed SAML
objects tightly bound to each security context, such that they cannot
be pulled out and validated without reference to the security context
they were associated with?  This question is relevant to how tightly
the CAMMAC should be bound to the carrying Ticket (see below).

>  - KDCissued uses the session key of the ticket, but the draft uses the

One possible compromise would be to derive a key for CAMMAC from the
Ticket's session key.  This way the sub-key can be passed around with
the CAMMAC but without the Ticket, and still be validated.

>   this work, but specifying SAML authz data is in-scope for the WG.

Agreed.

>  - Issue of central home directories and PAD-Posix-Homedir will be taken

I think we have consensus for Jeff's proposal now.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Fri, 17 Feb 2012 08:46:10 -0500

Nico, did you intend these as corrections to the minutes?  It sounds
like you're discussing things happening after the meeting.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg