Subject: [kitten] IANA number assignment for checksum type

From: Jishnu Renugopal <[email-masked]>
Date: Wed, 9 Jun 2021 22:58:11 +0000

Hi folks,
We are working on adding new checksum types for the Windows implementation of Kerberos namely – SHA256, SHA384, and SHA512 – all unkeyed.
We were wondering if we can get IANA assignments for these types here: Kerberos Parameters (iana.org)<https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml#kerberos-parameters-2>.

Best,
Jishnu

---

From: Robbie Harwood <[email-masked]>
Date: Tue, 15 Jun 2021 12:45:33 -0400

Jishnu Renugopal <Jishnu.Renugopal=[email-masked]>
writes:

> Hi folks,
>
> We are working on adding new checksum types for the Windows
> implementation of Kerberos namely – SHA256, SHA384, and SHA512 – all
> unkeyed.
>
> We were wondering if we can get IANA assignments for these types here:
> Kerberos Parameters
> (iana.org)<https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml#kerberos-parameters-2>.

Hi,

It sounds like you're adding support for RFC 8009 (AES Encryption with
HMAC-SHA2 for Kerberos 5 - https://datatracker.ietf.org/doc/html/rfc8009
) - is that right?

That document defines aes128-cts-hmac-sha256-128 as 19 and
hmac-sha384-192-aes256 as 20 (section 7).  It looks like those are
reflected in the registry you link (though it's possible that's been
updated between your post and my reply).

Thanks,
--Robbie

---

From: Jishnu Renugopal <[email-masked]>
Date: Tue, 15 Jun 2021 20:39:23 +0000

From: Robbie Harwood<mailto:[email-masked]>
Sent: Tuesday, June 15, 2021 9:45 AM
To: Jishnu Renugopal<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: [EXTERNAL] Re: [kitten] IANA number assignment for checksum type

Hi,

Thanks,
--Robbie

We are implementing RFC 8636 partially.
Instead of rfc8636 (ietf.org)<https://datatracker.ietf.org/doc/html/rfc8636#section-3> which updates paChecksum from RFC 4556 where it is always a SHA1 checksum; we are extending pkauthenticator to include other checksums also. In this case, SHA2.

Best,
Jishnu

---

From: Robbie Harwood <[email-masked]>
Date: Fri, 18 Jun 2021 12:31:32 -0400

Jishnu Renugopal <[email-masked]> writes:

> Instead of rfc8636
> (ietf.org)<https://datatracker.ietf.org/doc/html/rfc8636#section-3>
> which updates paChecksum from RFC 4556 where it is always a SHA1
> checksum; we are extending pkauthenticator to include other checksums
> also. In this case, SHA2.

Could you please not divert from RFC 8636?  The rest of the ecosystem
already implemented this RFC - it would be rather frustrating if
Microsoft decided to implement something different from everyone else.
This is doubly true since this is a document we recently standardized,
and there were no objections to it at the time.

On a technical level, as it says in the registry link you used, new
assignments require either a standards-track RFC or expert review for
any other RFC.

--Robbie