Subject: Questions

From: Максим Коллегин <[email-masked]>
Date: Mon, 14 Jul 2003 12:06:24 +0400

Dear Sirs! 

We have an intention to implement protocol Kerberos based on Russian cryptographic algorithms. We would be very obliged to have your opinion and suggestions upon this question. The questions are as follows: which standard is needed to be realized (RFC 1510 or last draft (draft-ietf-krb-wg-kerberos-clarifications-04.txt)), and when this draft becomes RFC. 

We are thankful beforehand for any help.

Best regards, Max D. Kollegin 
CRYPTO-PRO            
w: +7 095 933-1168; USSR, Moscow, 127018, Obraztsova 38 
m: +7 926 227-1327
WWW: http://www.CryptoPro.ru
e-mail:   [email-masked]

---

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 14 Jul 2003 09:20:45 -0500

> Dear Sirs! 
> 
> <?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /> 
> 
> We have an intention to implement protocol Kerberos based on Russian cryptographic algorithms. We would be very obliged to have your opinion and suggestions
> upon this question. The questions are as follows: which standard is needed to be realized (RFC 1510 or last draft (draft-ietf-krb-wg-kerberos-clarifications-04.txt)),
> and when this draft becomes RFC. 
>

You should consider basing it on the three drafts: 

 The Kerberos Network Authentication Service (V5)
 http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-kerberos-clarifications-04.txt

 Encryption and Checksum Specifications for Kerberos 5
 http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-crypto-05.txt

 AES Encryption for Kerberos 5
 http://www.ietf.org/internet-drafts/draft-raeburn-krb-rijndael-krb-05.txt

These have all been submitted to the IESG for consideration as draft standard RFCs. 
I can not give you any time estimate on how long the process will take. 

The "Encryption and Checksum Specifications for Kerberos 5" specifies what is needed
from your cryptographic algorithms to fit within the Kerberos protocols. 

If you go ahead and implement a new crypto suite for Kerberos, you should write a document
similar to the "AES Encryption for Kerberos 5" to be compliant with these draft RFCs,
and compatible with existing implementations. In particular please read section 8 of the
"Encryption and Checksum Specifications for Kerberos 5" and discuss with the krb-wg the 
etype you would use. 

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444