Subject: [kitten] Consensus Calls

From: Shawn M Emery <[email-masked]>
Date: Fri, 06 Sep 2013 14:31:05 -0600

The WG is making the following consensus calls (which were formulated 
from Berlin's meeting held on August 1st):

1. In regards to draft-ietf-kitten-sasl-oauth; should we remove the GS2 
related text from the draft and continue the proceed to shepherd this as 
an RFC?

a. Yes
b. No
c. Don't care or need more information

2. Should the WG recharter and adopt the 
draft-williams-kitten-generic-naming-attributes draft?

a. Yes
b. No
c. Don't care or need more information

3. Should the WG recharter and adopt the 
draft-williams-kitten-krb5-pkcross draft?

a. Yes
b. No
c. Don't care or need more information

Please provide your input before September 20th.  Thank you.

Shawn.
--
kitten co-chair

---

From: Bill Mills <[email-masked]>
Date: Fri, 6 Sep 2013 15:38:17 -0700

1> Yes
2&3> Don't have an opinion.

-bill

--------------------------------
William J. Mills
"Paranoid" Yahoo!

________________________________
 From: Shawn M Emery <[email-masked]>
To: [email-masked] 
Sent: Friday, September 6, 2013 1:31 PM
Subject: [kitten] Consensus Calls

a. Yes
b. No

a. Yes
b. No

a. Yes
b. No

Shawn.
--
kitten co-chair
_______________________________________________
Kitten mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/kitten

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Fri, 6 Sep 2013 22:45:44 +0000

>c. Don't care or need more information

Yes.

For other questions "C".

Cheers,
Morteza

---

From: "Matt Miller (mamille2)" <[email-masked]>
Date: Mon, 9 Sep 2013 13:45:32 +0000

1) Yes
2) No opinion
3) No opinion

- m&m

Matt Miller < [email-masked] >
Cisco Systems, Inc.

---

From: "Cantor, Scott" <[email-masked]>
Date: Mon, 9 Sep 2013 13:56:54 +0000

1. Don't care.

2. Yes

3. Don't care.

-- Scott

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 09 Sep 2013 10:10:07 -0600

On 9/6/13 2:31 PM, Shawn M Emery wrote:

> The WG is making the following consensus calls (which were
> formulated from Berlin's meeting held on August 1st):

1. yes
2. don't care
3. don't care

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Simo Sorce <[email-masked]>
Date: Mon, 09 Sep 2013 15:07:19 -0400

> related text from the draft and continue the proceed to shepherd this as 

c. Need more information

a. Yes

> draft-williams-kitten-krb5-pkcross draft?

c. Need more information

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

---

From: Nico Williams <[email-masked]>
Date: Mon, 9 Sep 2013 14:25:40 -0500

> 1. In regards to draft-ietf-kitten-sasl-oauth; should we remove the GS2
related text from the draft and continue the proceed to shepherd this as an
RFC?
> c. Don't care or need more information

Yes, but that includes losing the -PLUS suffix.  It's not OK to keep that
suffix and not keep channel binding.

> c. Don't care or need more information

Yes.  I'd pursue it as an individual submission if not accepted, fyi.  It'd
be silly to have published rfc6680 and then not specify any actual naming
attribute.

> c. Don't care or need more information

Yes.  Kerberos needs at least a strong method for exchanging symmetric
x-realm keys.  The only implementation that provides that is AD, and only
between realms in AD forests and between forests.  Anyone who's been
involved in manual keying or rekeying of x-realm trusts can attest to it's
awfulness, and rekeying in particular is really difficult to perform
without outages.

Nico
--

---

From: "Henry B. Hotz" <[email-masked]>
Date: Mon, 9 Sep 2013 13:13:14 -0700

On Sep 6, 2013, at 1:31 PM, Shawn M Emery <[email-masked]> wrote:

> The WG is making the following consensus calls (which were formulated from Berlin's meeting held on August 1st):

1) Don't care.
2) Haven't read it.
3) Yes
------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: Bill Mills <[email-masked]>
Date: Mon, 9 Sep 2013 13:44:43 -0700

> Yes, but that includes losing the -PLUS suffix.  It's not OK to keep that suffix and not keep channel binding.

Tearing out CB is a separate question in my opinion, can we have a separate consensus call on this?  I'm not opposed to it, I just think it's different.  Given the practical challenges in getting the channel binding information from the current context is the app stacks I doubt CB will in fact be implemented, so pulling CB has little impact I think.

There hasn't been a lot of movement on the CB stuff, perhaps because no-one has actually implementing.  We can pull it and I'll help author/define it as a different draft if there's demand for it later if that's what folks want.

-bill

________________________________
 From: Nico Williams <[email-masked]>
To: Shawn M Emery <[email-masked]> 
Cc: [email-masked] 
Sent: Monday, September 9, 2013 12:25 PM
Subject: Re: [kitten] Consensus Calls

On Sep 6, 2013 3:30 PM, "Shawn M Emery" <[email-masked]> wrote:
> 1. In regards to draft-ietf-kitten-sasl-oauth; should we remove the GS2 related text from the draft and continue the proceed to shepherd this as an RFC?
>
> a. Yes
> b. No
Yes, but that includes losing the -PLUS suffix.  It's not OK to keep that suffix and not keep channel binding.
> 2. Should the WG recharter and adopt the draft-williams-kitten-generic-naming-attributes draft?
>
> a. Yes
> b. No
Yes.  I'd pursue it as an individual submission if not accepted, fyi.  It'd be silly to have published rfc6680 and then not specify any actual naming attribute.
> 3. Should the WG recharter and adopt the draft-williams-kitten-krb5-pkcross draft?
>
> a. Yes
> b. No
Yes.  Kerberos needs at least a strong method for exchanging symmetric x-realm keys.  The only implementation that provides that is AD, and only between realms in AD forests and between forests.  Anyone who's been involved in manual keying or rekeying of x-realm trusts can attest to it's awfulness, and rekeying in particular is really difficult to perform without outages.
Nico
-- 
_______________________________________________
Kitten mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/kitten

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 11 Sep 2013 10:55:34 +0100

On 09/09/2013 21:44, Bill Mills wrote:
>
> > Yes, but that includes losing the -PLUS suffix.  It's not OK to keep 
> that suffix and not keep channel binding.
>
> Tearing out CB is a separate question in my opinion, can we have a 
> separate consensus call on this?  I'm not opposed to it, I just think 
> it's different.  Given the practical challenges in getting the channel 
> binding information from the current context is the app stacks I doubt 
> CB will in fact be implemented, so pulling CB has little impact I think.
>
> There hasn't been a lot of movement on the CB stuff, perhaps because 
> no-one has actually implementing.  We can pull it and I'll help 
> author/define it as a different draft if there's demand for it later 
> if that's what folks want.

I can tell you that we (Isode) implemented TLS channel binding using 
Cyrus SASL and openssl in both our clients and servers. So channel 
binding support in the OAuth mechanism are of interest to us.

> ------------------------------------------------------------------------
> *From:* Nico Williams <[email-masked]>
> *To:* Shawn M Emery <[email-masked]>
> *Cc:* [email-masked]
> *Sent:* Monday, September 9, 2013 12:25 PM
> *Subject:* Re: [kitten] Consensus Calls
>
>
> On Sep 6, 2013 3:30 PM, "Shawn M Emery" <[email-masked] 
> <mailto:[email-masked]>> wrote:
> >
> >
> > 1. In regards to draft-ietf-kitten-sasl-oauth; should we remove the 
> GS2 related text from the draft and continue the proceed to shepherd 
> this as an RFC?
> >
> > a. Yes
> > b. No
> Yes, but that includes losing the -PLUS suffix.  It's not OK to keep 
> that suffix and not keep channel binding.
> Yes.  I'd pursue it as an individual submission if not accepted, fyi.  
> It'd be silly to have published rfc6680 and then not specify any 
> actual naming attribute.
> x-realm keys.  The only implementation that provides that is AD, and 
> only between realms in AD forests and between forests. Anyone who's 
> been involved in manual keying or rekeying of x-realm trusts can 
> attest to it's awfulness, and rekeying in particular is really 
> difficult to perform without outages.
> Nico
> --

---

From: Sam Hartman <[email-masked]>
Date: Tue, 17 Sep 2013 13:04:33 -0400

I don't think CB can stay without mutual auth.

At the GSS layer, perhaps we can talk about CB without mutual auth,
although I find that very confusing.  However, for SASL, what people
generally want from CB strongly requires mutual auth.

---

From: Tom Yu <[email-masked]>
Date: Thu, 19 Sep 2013 22:52:14 -0400

a. Yes

But I also agree with comments by Nico and Sam.

a. Yes

a. Yes

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 19 Sep 2013 23:57:43 -0400 (EDT)

> c. Don't care or need more information

(a) Yes.

> c. Don't care or need more information

(a) Yes.

> c. Don't care or need more information

(a) Yes.

-Ben