Subject: [kitten] Shepherding draft-ietf-krb-wg-pkinit-alg-agility

From: Josh Howlett <[email-masked]>
Date: Thu, 14 Feb 2013 11:50:29 +0000

I'm picking up from Jeff in shepherding
draft-ietf-krb-wg-pkinit-alg-agility.

I've taken a look through the outstanding issues. My only substantial
concern relates to the Kerberos error code 82 conflict:

http://www.ietf.org/mail-archive/web/krb-wg/current/msg04016.html

Sam claims that there shouldn't be a situation where an unknown well-known
principal name is
used in conjunction with PKINIT algorithm agility. Tom thinks this is
possible, but unlikely. Greg has a preference to reassign the error code
even though there is shipping code as (if I've understood him) the
implications for deployers are likely to be modest.

It's difficult to judge consensus from this, and so my proposal is that we
reassign the error code. This may cause some short term pain for
deployers, but avoid potential (if not necessarily likely) longer term
consequences that could cause issues in the future. Please comment -- I
would welcome feedback from deployers in particular.

Thanks, Josh.

Kitten WG co-chair

Janet(UK) is a trading name of Jisc Collections and Janet Limited, a 
not-for-profit company which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

---

From: Sam Hartman <[email-masked]>
Date: Thu, 14 Feb 2013 07:29:53 -0500

>>>>> "Josh" == Josh Howlett <[email-masked]> writes:

    Josh> Sam claims that there shouldn't be a situation where an
    Josh> unknown well-known principal name is used in conjunction with
    Josh> PKINIT algorithm agility. Tom thinks this is possible, but
    Josh> unlikely. Greg has a preference to reassign the error code
    Josh> even though there is shipping code as (if I've understood him)
    Josh> the implications for deployers are likely to be modest.

Having evaluated the impact, I too have a preference to reassign the
error code even given the deployed code.

---

From: Josh Howlett <[email-masked]>
Date: Mon, 18 Feb 2013 16:37:55 +0000

>error code even given the deployed code.

Ok -- it sounds as though a rewrite is needed to fix that.

There were a few other out-standing issues:

 * Jeff suggested that the RFC3766 and RFC6194 references should be
informative. I agree.

 * Jeff suggested that an informative reference to the MD4 spec might be
useful. I see no harm in adding this reference, but I am satisfied that
the existing reference to RFC6150 meets the need if the authors would
prefer to stay with that.

 * The OID id-pkinit-kdc has been assigned, but not defined in the module
in Appendix A. In principle I'm happy with this, but I think Tom sounded a
note of caution so I'd like to flag this again. Please pipe up if you have
a concern here.

Josh.

--
IETF Kitten WG co-chair