Subject: Status of the Working Group

From: "Douglas E. Engert" <[email-masked]>
Date: Wed, 14 Feb 2001 14:21:38 -0600

The deadline for new and revised drafts is drawing near. 

February 23 - Internet Draft Cut-off for initial document (-00) submission at 17:00 ET 
March 2 - Internet Draft final submission cutoff date at 1700 ET 

The working group has issued a last call on PKINIT, and received comments
from two people. I am still waiting for the authors to respond to these comments
before closing the last call. 

I have talked to Cliff Neuman about the revisions, and he has promise a new
draft. This should include some of the name canonicalization, but most has
been removed. It should also include a new section 6 which Ken Raeburn 
has provided to him, which is a framework for encryption system for Kerberos.

Ken Raeburn is working on draft(s) to match the framework and will include
documenting the current DES encryption, the 3DES encryption and eventually AES. 
Ken can you give us an update on your plans for these? The framework would also allow
Microsoft to add a draft on the RC4-MD5 that they have implemented in W2K. 
 
John Brezak and Jonathan Trostle are working on the Referrals so as to 
cover the name canonicalization parts not included in the Revisions. 

So I am expecting to see drafts from:

  Cliff Neuman - Revisions
  Ken Raeburn  - Encryption (1 2 or 3 drafts?) 
  Brezak/Trostle - Referrals and name canonicalization. 

The main agendia items for the next meeting would be:

  Revisions
  Encryption
  Referrals
  PKINIT - (If questions on last call cannot be resolved)
  Password change protocol

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Ken Raeburn <[email-masked]>
Date: 14 Feb 2001 20:26:07 -0500

> Ken Raeburn is working on draft(s) to match the framework and will
> include documenting the current DES encryption, the 3DES encryption
> and eventually AES.  Ken can you give us an update on your plans for
> these? The framework would also allow Microsoft to add a draft on
> the RC4-MD5 that they have implemented in W2K.

My revision of section 6 should have come through already.  My
mailer's log file says it was delivered to dns2.anl.gov (MX site for
anl.gov) yesterday at 16:12:42 EST.  But I don't seem to have gotten a
copy back, and the list archive's modification time right now seems to
be sometime yesterday afternoon.  In case there's some problem with
large messages -- and with getting bounce reports back to me when I
send stuff from my laptop -- I've put a copy at
http://www.mit.edu/~raeburn/krbrev6-kr.html .  Tom Yu has already
pointed out one problem I need to look into.

That draft includes the framework and the revised descriptions of DES
and 3DES.  It also provides facilities that preauth schemes like
kerberos-passwords-04 and pk-init-12 should be able to build on, so
they don't need to include algorithms for generating Kerberos keys
from whatever random data they produce.  I've tried to be compatible
with their existing specs for DES, but PKINIT/3DES was a problem.

I'll be revising the AES draft to use the framework, but possibly not
in time for the submission deadline; aside from this change, there
probably won't be anything new anyways.  The only other new thing I
can report since I spoke at the last IETF meeting is that yes, I've
thought a little more about the new proposed modes of operation, and
I'm inclined to be conservative and stick with CBC mode for now.  We
can certainly consider other modes later on, after NIST has made their
decision, and the IP issues are cleared up.  But it doesn't really
hurt us to be conservative for now.

Ken