Subject: Re: Reactivating the IETF CAT WG and IETF-GGF Cooperation

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 03 Feb 2003 12:58:25 -0600

"Jeffrey I. Schiller" wrote:
> 
> The CAT WG was shutdown because the chair wanted to move on. We shut it
> down and created the KRB WG because all of the outstanding work in CAT
> was really Kerberos stuff.
> 
> Can I assume that your message implies that the folks in the IETF
> Kerberos WG are not interested in working on these documents? 

I was assuming that GSSAPI, and SPNEGO where outside the
scope of the KRB-WG, as they can use Kerberos, but do not define it.
This is especial true for the GSSAPI as it is mean to be generic,
and there are implementations which are not Kebeeros based.  
Most of the same people who are on the Kerberos WG where on the CAT
and this is where the concerns for SPNEGO are comming from. 

> If so,
> then we are stuck, because I don't believe we have any other
> constituency. On the other hand if you believe that there are folks
> interested in fixing the documents, but believe that the Kerberos WG
> isn't the correct venue, then we can create a BOF on the topic to help
> charter the path forward... which is to say come up with a formal
> charter and a chair.

Well then this may be the way to go. I wil cc the krb-wg on this.

I would still lkke to see thre IETF Security ADs talk to the GGF Securit-ADs
at some point to discuss some of these overlapping areas of concern. 

> 
>                         -Jeff
> 
>   --------------------------------------------------------------------------------------------
>    Part 1.2Type: application/pgp-signature

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Sam Hartman <[email-masked]>
Date: Mon, 03 Feb 2003 14:21:32 -0500

Jeff, is there any reason we can't just fix the documents as
individual submissions?  The only really critical flaw seems to be in
the SPNEGO document.

It may turn out in that there is interested in revisiting GSSAPI in
the future, but I'm not convinced people have time right now.

---

From: "Jeffrey I. Schiller" <[email-masked]>
Date: Mon, 03 Feb 2003 14:49:29 -0500

<[email-masked]> <[email-masked]>
Sender: [email-masked]

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigDF4BC9BD8D8E6F83F068C94B
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

This is also a possibility. -Jeff

> the future, but I'm not convinced people have time right now.

--------------enigDF4BC9BD8D8E6F83F068C94B
Content-Type: application/pgp-signature

--------------enigDF4BC9BD8D8E6F83F068C94B--

---

From: Martin Rex <[email-masked]>
Date: Mon, 3 Feb 2003 21:49:46 +0100 (MET)

> individual submissions?  The only really critical flaw seems to be in

Is the currently perceived ambiguity about what exact Bits get signed
where the spec says "a call to gss_GetMIC() on mechTypes" the
"critical flaw" that you're referring to?

However the document that really needs major surgery is the IAKERB
proposal -- and when all use and references ot SPNEGO by IAKERB
have been removed and IAKERB is completely integrated into
rfc1964-bis then the SASL-draft for Kerberos with initial authentication
becomes redundant.

-Martin

> the future, but I'm not convinced people have time right now.

What exactly do you have in mind when you're thinking about
"revising GSSAPI"?  The spec is quite mature and consistent,
and it has been widely adopted (in those areas where apps don't
hard-code to a particular crypto-system).

---

From: Jeffrey Altman <[email-masked]>
Date: Mon, 03 Feb 2003 16:09:14 -0500

>hard-code to a particular crypto-system).
I believe the references to GSSAPI are related to the work by the Global 
Grid Forum.