Subject: [Cfrg] Kerberos crypto framework

From: Ken Raeburn <[email-masked]>
Date: Fri, 04 Apr 2003 19:38:34 -0500

The Kerberos working group ([email-masked]) has two drafts we're
finishing up that could use some review by people with real crypto
backgrounds, unlike some of us total amateurs who are working on the
drafts.  We'd appreciate any comments people may have.

These documents attempt to:

 - describe an "interface" for cryptographic functionality for use in
   Kerberos and related protocols and extensions, with what we hope
   will be all the operations we need
 - describe a profile system for additional encryption systems (e.g.,
   Microsoft's RC4, or PacketCable's version of 3DES)
 - specify profiles for some existing encryption systems used by
   Kerberos (DES and 3DES), and some known problems with them
 - specify a profile for using AES in Kerberos

The first document
http://www.mit.edu/~raeburn/draft-ietf-krb-wg-crypto-04.txt covers the
first three points, and should go to WG last call as soon as it gets
published in the I-D area.  The somewhat arbitrary crypto
specifications were pulled out of various versions of the Kerberos
protocol specification into a separate specification, and a somewhat
generalized framework added at that time.  We actually specify two
types of profiles for encryption systems, a low-level more detailed
one, and a simplified one needing fewer parameters specified, with a
process for deriving the more detailed one from it.  The DES and 3DES
mechanisms are defined for compabitibility with existing
implementations.

The second document, draft-raeburn-krb-rijndael-krb-03.txt, in WG last
call now, gives a profile for plugging AES into the framework
specified in the first document, and stands as an example of how to
define a new encryption system for Kerberos.  AES support will be
required for version 5.2 of the Kerberos protocol (also in WG last
call).

We're hoping to finish up the working group last call and move on to
IETF-wide last call soon.  Any comments people have would be welcome.

Ken
_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "David A. Mcgrew" <[email-masked]>
Date: Fri, 11 Apr 2003 15:22:46 -0700

Ken,

thanks for pointing out these drafts.  You mention that
draft-raeburn-krb-rijndael-krb-03.txt is in WG last call (good to see AES
adoption :-).  Is draft-ietf-krb-wg-crypto-04.txt in last call as well?  If not,
I assume that it would be good for reviewers to concentrate on the former.

More inline:

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Ken
> Raeburn
> Sent: Friday, April 04, 2003 4:39 PM
> To: [email-masked]
> Subject: [Cfrg] Kerberos crypto framework
>
>

>    Microsoft's RC4, or PacketCable's version of 3DES)

I didn't see references for these mechanisms.  Are there IDs describing them?

> IETF-wide last call soon.  Any comments people have would be welcome.

Sounds good.  I'm sure that the WG is eager to move to AES, so I encourage all
interested CFRGites to check it out.

Note to KDF fans: Section 4.1. of draft-ietf-krb-wg-crypto-04.txt defines a key
derivation function :-)

David

---

From: Ken Raeburn <[email-masked]>
Date: Sat, 12 Apr 2003 19:11:39 -0400

> I assume that it would be good for reviewers to concentrate on the former.

Actually, the former just finished WG last call, but we have one issue
to work out, and either another WG last call or IETF last call should
be coming up soon.  The crypto draft is still in WG last call, but the
WG chair only specified a one-week WG last call, meaning that's about
to end (though I think that means we get a longer IETF last call
period).  Of course, no one needs to wait for the IETF last call to
make comments. :-)

> I didn't see references for these mechanisms.  Are there IDs describing them?

There was an old I-D describing the RC4 system, but not based on the
framework presented.  There's occasionally talk about reworking that
draft to describe a profile for the crypto framework, but I don't know
if anyone's working on it at the moment.

The Packet Cable folks are, I believe, using some old 3DES code that
never got properly written up.

All that's in the crypto draft is (should be) enough of a framework
and descriptions of the necessary parameters to produce a complete and
interoperable profile for either of these systems.  As opposed to what
we had before, where some of the crypto stuff was collected in one
place, some kind of scattered throughout the rest of the Kerberos
document, and some just left unspecified.

> Note to KDF fans: Section 4.1. of draft-ietf-krb-wg-crypto-04.txt defines a key

Yep.  We can't have too many home-grown key derivation functions, can
we? :-(

This one was specified by Marc Horowitz several years ago in another
I-D, and folded into an earlier Kerberos I-D before the crypto stuff
was broken out again.

Ken