headers
Sam Hartman | 1 Aug 2011 15:49
Picon
Favicon

Where are we with the preauth nonce discussion


I'm hoping that discussion continues to a point where we reach consensus
by the time IETF LC starts.
Have things died down because people are in agreement? If so, I missed
the agreement. Or did the ball get dropped?
_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg <at> lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
Permalink | Reply | 11 comments |
headers
Greg Hudson | 1 Aug 2011 16:35
Picon
Favicon

Re: Where are we with the preauth nonce discussion

On Mon, 2011-08-01 at 09:49 -0400, Sam Hartman wrote:
> I'm hoping that discussion continues to a point where we reach consensus
> by the time IETF LC starts.

I was going to propose text, but then you wrote something which made me
think I should wait until IETF last call.

Based on the last message from Gareth
(https://lists.anl.gov/pipermail/ietf-krb-wg/2011-July/009492.html) I
think we have agreement to add a timestamp to PA-OTP-ENC-REQUEST and use
it in 2-pass mode instead of PA-ENC-TS-ENC.  I'll propose specific text
later in the day.

(I still feel like the nonce and PA-OTP-ENC-REQUEST are unnecessary
complexity in the most common expected use case, which is where the
client and reply key are equal to the armor key.  But I think I am too
late in the process to be trying to remove complexity at that level of
detail.)

_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg <at> lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
Permalink | Reply | 10 comments |
headers
Sam Hartman | 1 Aug 2011 17:15
Picon
Favicon

Re: Where are we with the preauth nonce discussion

>>>>> "Greg" == Greg Hudson <ghudson <at> MIT.EDU> writes:

    Greg> On Mon, 2011-08-01 at 09:49 -0400, Sam Hartman wrote:
    >> I'm hoping that discussion continues to a point where we reach
    >> consensus by the time IETF LC starts.

    Greg> I was going to propose text, but then you wrote something
    Greg> which made me think I should wait until IETF last call.

    Greg> Based on the last message from Gareth
    Greg> (https://lists.anl.gov/pipermail/ietf-krb-wg/2011-July/009492.html)
    Greg> I think we have agreement to add a timestamp to
    Greg> PA-OTP-ENC-REQUEST and use it in 2-pass mode instead of
    Greg> PA-ENC-TS-ENC.  I'll propose specific text later in the day.

Note that I see a higher bar for changing the ASN.1 structure at this
point than I see for changing the form of the nonce field.  In
particular I'll want to hear from all the folks who have indicated
implementation work in the past if we're going to change the module
post-WG-LC.
I think that means the folks from Cybersafe, Linus and Redhat.
Am I missing any parties?
_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg <at> lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
Permalink | Reply | 9 comments |
headers
Greg Hudson | 2 Aug 2011 07:43
Picon
Favicon

Re: Where are we with the preauth nonce discussion

On Mon, 2011-08-01 at 11:15 -0400, Sam Hartman wrote:
> Note that I see a higher bar for changing the ASN.1 structure at this
> point than I see for changing the form of the nonce field.

Well, in that case, I suggest changing the text in section 4.1 from:

        This nonce string MUST be as long as the longest key length of
        the symmetric key types that the KDC supports and MUST be chosen
        randomly.

to

        This nonce string MUST contain a randomly chosen component at
        least as long as the longest key length of the symmetric key
        types that the KDC will include PA-ETYPE-INFO2 entries for in
        the reply.

The KDC can then compose a nonce out of a random component and a
timestamp.

_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg <at> lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
Permalink | Reply | 8 comments |
headers
Sam Hartman | 2 Aug 2011 13:06
Picon
Favicon

Re: Where are we with the preauth nonce discussion

OK, I'd like to hear comments on this proposed change. Even if you've
expressed support for similar concepts in the past, express support now.
We'll count Greg in favor without another message from him.:-)

Sam Hartman
Kerberos Working Group Co-Chair
_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg <at> lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
Permalink | Reply | 7 comments |
headers
Simon Wilkinson | 2 Aug 2011 17:00
Picon

Re: Registering key usage values


On 16 Jul 2011, at 16:48, Simon Wilkinson wrote:

> In the absence of any progress with draft-lha-krb-wg-some-numbers-to-iana-00, what is the current
mechanism for registering RFC3961 key usage values? I would like to register 6 values for OpenAFS's
forthcoming rxgk implementation.

I asked this a couple of weeks ago, without response.

Is there any mechanism for registering these at present, or should we just pick some apparently unused
values and try to grandfather them in whenever a new draft of lha-krb-wg-some-numbers-to-iana appears?

Thanks,

Simon.

_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg <at> lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
Permalink | Reply | 3 comments |
headers
ghudson | 2 Aug 2011 17:06
Picon
Favicon

Re: Registering key usage values

> I asked this a couple of weeks ago, without response.

You received a response from Sam:

https://lists.anl.gov/pipermail/ietf-krb-wg/2011-July/009423.html
_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg <at> lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
Permalink | Reply | 0 comments |
headers
Simon Wilkinson | 2 Aug 2011 17:09
Picon

Re: Registering key usage values


On 2 Aug 2011, at 16:00, Simon Wilkinson wrote:

> On 16 Jul 2011, at 16:48, Simon Wilkinson wrote:
> 
>> In the absence of any progress with draft-lha-krb-wg-some-numbers-to-iana-00, what is the current
mechanism for registering RFC3961 key usage values? I would like to register 6 values for OpenAFS's
forthcoming rxgk implementation.
> 
> I asked this a couple of weeks ago, without response.

It has just pointed out off list that I'd missed Sam's response. I believe that the application range will
solve our problem, so please just ignore me!

Cheers,

Simon.

_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg <at> lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
Permalink | Reply | 1 comment |
headers
Sam Hartman | 2 Aug 2011 17:39
Picon
Favicon

Re: Registering key usage values

>>>>> "Simon" == Simon Wilkinson <simon <at> sxw.org.uk> writes:

    Simon> On 2 Aug 2011, at 16:00, Simon Wilkinson wrote:

> On 16 Jul 2011, at 16:48, Simon Wilkinson wrote:
> 
>> In the absence of any progress with draft-lha-krb-wg-some-numbers-to-iana-00, what is the current
mechanism for registering RFC3961 key usage values? I would like to register 6 values for OpenAFS's
forthcoming rxgk implementation.
    >> 
    >> I asked this a couple of weeks ago, without response.

    Simon> It has just pointed out off list that I'd missed Sam's
    Simon> response. I believe that the application range will solve our
    Simon> problem, so please just ignore me!

If for some reason you decide the application range is inappropriate,
contact Tom Yu (tlyu <at> mit.edu).  I'd far prefer you use the application
range than squat on a code point. My personal preferencebelief is that
the application range is fine.  However, key usages are intended to be
first-come-first-serve in Love's draft, so if you want some, I think you
should be able to get them.

We are trying to progress the iana draft; I hope to be done by the next
IETF, but it may drag out until end of year.
_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg <at> lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
(Continue reading)

Permalink | Reply | 0 comments |
headers
Shawn Emery | 3 Aug 2011 09:31
Picon
Favicon

Re: Comments on adopting draft-sorce-krbwg-general-pad as a work item

On 07/17/11 05:11 PM, Simo Sorce wrote:
> On Mon, 2011-07-11 at 00:23 -0600, Shawn Emery wrote:
>> On 07/10/11 07:27 AM, Simo Sorce wrote:
>>> On Sun, 2011-07-10 at 01:04 -0600, Shawn Emery wrote:
>>>> On 06/29/11 08:11 AM, Sam Hartman wrote:
>>>>> The chairs would like to solicit comments on whether the PAD draft is
>>>>> ready for us to adopt as a working group draft.
>>>>> Please send comments by July 10.
>>>> Sorry for the late reply...
>>>>
>>>> General:
>>>>
>>>> It would be nice to standardize the interface (C bindings) or provide
>>>> examples for accessing PAC data through standards track interfaces.
>>>>
>>>> There have been implementations of non-standardized interfaces, such
>>>> as gss_inquire_sec_context_by_oid.  It would be out of scope for this
>>>> draft to cover a GSS-API like this, but should be considered as a
>>>> complimentary draft.
>>>>
>>>> 4.4 PAD-DNS-Domain
>>>>
>>>>       Couldn't you also have multiple domains map to a single realm?
>>> This refers to the main domain name in use, others can be available but
>>> they are not relevant for user authorization data.
>>>
>>>> 4.6. PAD-Domain-UUID
>>>>
>>>>       uuid_t is 128 bits, shouldn't this be in alignment with uuid*
>>>> functions?
(Continue reading)

Permalink | Reply | 11 comments |

Gmane