Subject: RE: Refactoring Kerberos pre-authentication

From: Medvinsky Alexander-MGI1174 <[email-masked]>
Date: Mon, 15 Sep 2003 22:04:05 -0700

However there are no significant differences between PKINIT drafts version 9 and 16.  Changes made between those two versions were in large part editorial and also attempted to fix some inconsistencies, e.g., in version 9 Diffie-Hellman OID was specified correctly in some places and incorrectly in others.

So you can consider both Microsoft and PacketCable PKINIT implementations as the same issue.  The latest PKINIT draft that Brian Tung is writing would most likely be compatible with Microsoft implementations of v.9 draft.

-----Original Message-----
From: Jeffrey Altman [mailto:[email-masked]]
Sent: Monday, September 15, 2003 7:38 PM
To: [email-masked]
Subject: Re: Refactoring Kerberos pre-authentication

Eric:

I really don't want to have this argument, but if you were concerned 
about the installed base you would have stopped at -9 which is the 
version implement by Microsoft since their installed base is 
significantly larger than the PacketCable installed base.

I am not going to go out of my way to force gratuituous changes to the 
protocol for the purpose of breaking compatibility.  However, given the 
issues on the table I think it is going to be very hard not to.  As we 
discussed on the phone, due to the widespread implementation of 
Microsoft's PKINIT we do not have a choice but to change the Preauth 
Type Identifiers.  This may not be a problem for PacketCable since your 
use of this protocol is (I believe) within a somewhat closed world but 
it is certainly an issue for the rest of us.

As for the Kerb WG being unable to meet the needs of PacketCable this is 
true.  The limited available time of the group members combined with the 
need to come to a consensus on Clarifications and Extensions prevented 
us from spending time on PK-INIT.  We had enough time to read the drafts 
and determine that there were serious problems with it.  We did not have 
time to spend to fix it.  We welcome the fact that PacketCable is now 
interested in contributing to the working group efforts.  Perhaps with 
the assistance of addition dedicated workers we can move things forward 
more quickly.  But moving quickly does not mean compromising on security 
or the integrity of the Kerberos protocol.

We will talk about the outstanding issues tomorrow.  See you then.

- Jeff

Eric Rosenfeld wrote:

>Jeff,
>
>True.  But one could reasonably argue that the reason why there is such
>a large deployed base is because the Kerb WG was unable to meet the
>needs, and timeline, of its users.  This same group should not now be
>punished because the WG is just now catching up.
>
>Of course, I won't make that argument.  I would just request that this
>WG minimize the impact, as much as possible, to existing products.  The
>impact to existing product is much less if some identifier values are
>changed, as opposed to fundamentally changing message contents or
>encoding, for example.  This is because the amount of code that needs to
>be changed is far greater in the latter case, and thus the potential for
>error is also far greater.
>
>I don't believe any hands are being tied here, but I do believe
>sensitivity towards an installed base should be part of the decision
>making criteria.
>
>Regards,
>Eric
>  
>