Subject: RE: Refactoring Kerberos pre-authentication

From: Medvinsky Alexander-MGI1174 <[email-masked]>
Date: Thu, 11 Sep 2003 15:07:33 -0700

With a relatively large number of vendors that have already implemented PKINIT 16, I hope that it can advance to a standards track RFC without any significant changes, except for removal of some options that no one is using.  There could be a successor to PKINIT that is also on standards track, similar to Kerberos extensions vs. clarifications.

-----Original Message-----
From: Joel N. Weber II [mailto:[email-masked]]
Sent: Thursday, September 11, 2003 2:20 PM
To: Medvinsky Alexander-MGI1174
Cc: [email-masked]
Subject: Re: Refactoring Kerberos pre-authentication

I believe it is probably desireable to get PKINIT 16 to a publishable
state, regardless of whether we end up with a more general framework.
If we do end up agreeing to a more general framework, we may want to
publish a revised document that is essentially the PKINIT 16 protocol
as an informational RFC.

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 11 Sep 2003 15:12:24 -0700

On Thu, Sep 11, 2003 at 03:07:33PM -0700, Medvinsky Alexander-MGI1174 wrote:
> With a relatively large number of vendors that have already
> implemented PKINIT 16, I hope that it can advance to a standards track
> RFC without any significant changes, except for removal of some
> options that no one is using.  There could be a successor to PKINIT
> that is also on standards track, similar to Kerberos extensions vs.
> clarifications.

Which PKINIT options are not currently used?

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Fri, 12 Sep 2003 14:07:49 -0400

>>>>> "Medvinsky" == Medvinsky Alexander-MGI1174 <[email-masked]> writes:

    Medvinsky> With a relatively large number of vendors that have
    Medvinsky> already implemented PKINIT 16, I hope that it can
    Medvinsky> advance to a standards track RFC without any
    Medvinsky> significant changes, except for removal of some options
    Medvinsky> that no one is using.  There could be a successor to
    Medvinsky> PKINIT that is also on standards track, similar to
    Medvinsky> Kerberos extensions vs. clarifications.

I do not believe it is in the IETF's interest to generate two pkinit
protocols.  I would be delighted for the protocol to be wire
compatible with your implementation of pkinit 16.

It would be nice if rather than starting out with a proposal to fork
the document, you made an honest effort to try and find ways of
modifying the document to do what we want within a compatible protocol
framework.

But no, the whole point of internet-drafts are that they are works in
progress and they change.  If you implement internet drafts, you
sometimes get to change your implementation.  You're already going to
get to change your implementation because the pa-type numbers will
eventually change; the question is how much more will you need to
change.

And your best options for doing that are to critically evaluate
whether the proposed changes need to be made, and if so,whether they
can be made in a way that avoids incompatible change.