Subject: Kerberos Working Group - IETF 58 Minutes (draft 0.1)

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 08 Dec 2003 20:24:05 -0500

Here's the first version of the minutes for our November meetings.  Please
check through and make sure nothing is missing or incorrect.  Pay special
attention to the XXX's; they mark gaps that need to be filled in.

I normally don't like sending out mail as HTML, but we've been told that
we need to do so unless we want the secretariat to reformat them.

I will likely want to submit this on or about Monday, Dec 15.

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Co-chair, IETF Kerberos Working Group
   Carnegie Mellon University - Pittsburgh, PA

---

From: Sam Hartman <[email-masked]>
Date: Tue, 09 Dec 2003 13:44:19 -0500

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> Here's the first version of the minutes for our November meetings.  Please
    Jeffrey> check through and make sure nothing is missing or incorrect.  Pay special
    Jeffrey> attention to the XXX's; they mark gaps that need to be filled in.

    Jeffrey> I normally don't like sending out mail as HTML, but we've been told that
    Jeffrey> we need to do so unless we want the secretariat to reformat them.

    Jeffrey> I will likely want to submit this on or about Monday, Dec 15.

    Jeffrey> -- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
    Jeffrey>    Co-chair, IETF Kerberos Working Group
    Jeffrey>    Carnegie Mellon University - Pittsburgh, PA

    Jeffrey>              Kerberos Working Group - IETF 58 Minutes (draft 0.1)

    Jeffrey>    WEDNESDAY, November 12, 2003
    Jeffrey>    0900-1130 Morning Sessions
    Jeffrey>    "Rochester" Meeting Room

    Jeffrey>    Chairs: Doug Engert <[email-masked]>
    Jeffrey>            Jeffrey Hutzelman <[email-masked]>
    Jeffrey>    Scribe: Kurt Zeilenga <[email-masked]>
    Jeffrey>    Jabber: Derek Atkins <[email-masked]>

    Jeffrey> Agenda Bashing

    Jeffrey>    Slides: #0 - krb-proceedings.txt
    Jeffrey>      * Larry Zhu will be talking about GSSAPI-CFX, instead of JK.
    Jeffrey>      * XXX Leif: infomodel? Jeffrey: at extensions

    Jeffrey> Milestones and WG Priorities

    Jeffrey>    Slides: #1 - milestones.doc

    Jeffrey>    Doug Engert presented a list of the group's current work items and
    Jeffrey>    some proposed milestones, with an eye toward establishing realistic
    Jeffrey>    goals for upcoming work and updating the list of milestones on the WG
    Jeffrey>    web page.
    Jeffrey>      * kcrypto, AES - "done" and sent to the IESG
    Jeffrey>      * kerberos clarifications - "done" and sent to IESG
    Jeffrey>        Sam Hartman noted that the IESG had sent comments to which the
    Jeffrey>        authors needed to respond.
    Jeffrey>      * kerberos-extensions - first draft by Thanksgiving, to IESG by
    Jeffrey>        March.
    Jeffrey>        Cliff Neuman wondered if this wasn't too aggressive. [The WG
    Jeffrey>        milestones list now says first draft in January, submit to IESG by
    Jeffrey>        April]
    Jeffrey>      * PKINIT
    Jeffrey>        Jeff Hutzelman reported on a meeting earlier in the week between
    Jeffrey>        the WG chairs and the PKINIT editor and contributors. Brian will
    Jeffrey>        send a new version of the document shortly after the IETF meeting,
    Jeffrey>        and another (hopefully with all the agreed-upon changes) sometime
    Jeffrey>        in January. The goal is to have the document submitted to the IESG
    Jeffrey>        by March.
    Jeffrey>      * set-change-pw - April, 2004
    Jeffrey>      * gssapi-cfx - February?
    Jeffrey>        Sam Hartman suggested January, but would be OK with February. [The
    Jeffrey>        WG milestones list says February]
    Jeffrey>      * preauth framework - May, 2004
    Jeffrey>      * PKCROSS
    Jeffrey>        The proposed milestone was July, 2004. Brian Tung said we should
    Jeffrey>        focus on PKINIT for now, and push PKCROSS to Fall, 2004 [The WG
    Jeffrey>        page says October]

    Jeffrey>    Doug asked Russ whether the AD's were OK with this list. Russ answered
    Jeffrey>    yes.

    Jeffrey> Pre-Authentication Framework - Sam Hartman

    Jeffrey>    Slides: #2 - hartmans-preauth.pdf

    Jeffrey>    Sam Hartman presented a proposal for a generic framework to describe

    Jeffrey>    Ken [XXX which Ken?] asked whether changes to existing preauth methods
    Jeffrey>    would be required. Sam indicated that the specs for such methods
    Jeffrey>    should probably be updated mainly because we need to do a security
    Jeffrey>    analysis, but that likely no on-the-wire changes would be needed. Ken
    Jeffrey>    indicated that he cared mostly about on-the-wire changes.

Hornstein

    Jeffrey>    Doug Engert asked whether the KDC would need to keep state. Sam
    Jeffrey>    responded XXX no record of response other than "design requirement".

It's a design requirement that the KDC not need to keep state.  This
means some mechanisms will need to carry cookies.

 about some minor changes to PKINIT to
    Jeffrey>    support anonymous DH and to sign KDC replies. Someone [XXX who?]
    Jeffrey>    indicated anon-DH wants an extra round trip.

It appears that pkinit cannot usefully be changed to support anon DH.
One of the main reasons is that anon DH requires an additional round
trip pkinit does not need.  It's looking like reusing the request
signing may not be that useful either because it's not clear how much
of the request it actually signs.