Subject: Short Summary - KRB-WG Salt Lake City

From: "Douglas E. Engert" <[email-masked]>
Date: Fri, 14 Dec 2001 07:55:19 -0600

[Comments from the attendees as to the correctness of these minutes are
    welcome. But PLEASE do NOT respond to this note with comments as to the merit 
    of any of these statements, till after I get the official minutes out. But feel 
    free to discuss the merits as separate threads. i.e. Don't respond
    to this note unless you where an attendee, and are commenting on the correctness
    of the minutes.]

The fifth meeting of the Kerberos WG was held on 12/13/01 in Salt Lake City with 44
attendees. 

An interim WG meeting is being planed to work on the revisions most likely in
early February at MIT. (The Security AD, gave verbally approval at the SAAG meeting.) 

The bulk of the meeting was devoted to the revisions lead by Cliff Neuman. Ken Raeburn
discussed Section 6, the Kerberos crypto. It will be moved to its own document as it 
is useful on its own and can be ready before revisions. The string-to-key and salt 
issues have also been resolved.  There are still some questions with password encoding 
and mixing keys with different preauthentication mechanisms. An AES draft will be a 
separate document.

Sam Hartman give a presentation on extensibility, using ASN.1 markers, typed holes, 
and new messages. It appears we have a good plan for extensibility, and there was 
general consensus that it is needed. But it is complicated and needs further study. 
Its to early to say if it should be in the revisions.

Jeff Altman then lead the discussion on UTF-8. In addition to realm and principal names,
there are other strings in the protocol which need to be examined. Interoperability
with deployed code is imperative. Relations ships of DNS names to realm names 
need to be considered and we need to work closely with the IDN working group.
Uniform normalization rules are need across all clients. 

Brian Tung addressed the comments to PKINIT from the last call. A new last call
will be done, as soon at the updated draft is available. RSA rather the DSA will
be required. 

Pat Moore gave an update on the GSS user-to-user information draft. There was
interest, and further discussion is needed. 

John Brezak asked for comments on the referrals draft. 

Matt Crawford spoke on the passwordless authentication draft which is ready for
last call. But the WG felt it was to overloaded with work on revisions to review
it at this time, so the last call will be postponed. 

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 14 Dec 2001 11:36:28 -0700 (MST)

On Fri, 14 Dec 2001, Douglas E. Engert wrote:

> Sam Hartman give a presentation on extensibility, using ASN.1 markers,
> typed holes, and new messages. It appears we have a good plan for
> extensibility, and there was general consensus that it is needed. But it
> is complicated and needs further study.

> Its to early to say if it should be in the revisions.

Since I'm the one who made this comment, let me clarify.  I certainly _do_
beleive a solution to the extensibility problem needs to be in revisions
-- in fact, I don't see how revisions can possibly be a viable document
without some solution to this problem. I also believe, based on the
meeting yesterday afternoon, that we have working group concensus that a
general extensibility solution is needed.

However, while I feel the solution we have proposed is a good one, we do
not yet have working group concensus that it is the correct approach
(though I certainly hope that we will develop such a concensus soon).
Until we do, it seems premature to edit the kerberos-revisions document to
reflect the proposal.

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Sr. Research Systems Programmer
   School of Computer Science - Research Computing Facility
   Carnegie Mellon University - Pittsburgh, PA