Subject: RFC1510 to historic?

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 05 Aug 2005 11:31:38 +0200

Now that RFC4120 has been published, if we want, we can ask the IESG to 
move RFC1510 to historic.  As I understand it, what's required to do that 
is a last call in this WG, followed by a note to the IESG.

So, does anyone want to move RFC1510 to historic?
Does anyone _not_ want to do so?

-- Jeff

---

From: Matt Crawford <[email-masked]>
Date: Fri, 05 Aug 2005 09:45:56 -0500

> Does anyone _not_ want to do so?

rfc-index.txt already says the right things:

1510 The Kerberos Network Authentication Service (V5). J. Kohl, C.
      Neuman. September 1993. (Format: TXT=275395 bytes) (Obsoleted by
      RFC4120) (Status: PROPOSED STANDARD)

4120 The Kerberos Network Authentication Service (V5). C. Neuman, T.
      Yu, S. Hartman, K. Raeburn. July 2005. (Format: TXT=340314 bytes)
      (Obsoletes RFC1510) (Status: PROPOSED STANDARD)

so I don't see the need for any such action.

---

From: Martin Rex <[email-masked]>
Date: Fri, 5 Aug 2005 17:38:34 +0200 (MET DST)

> Does anyone _not_ want to do so?

I think we should wait until the majority of the installed base
of RFC1510 implementations have been replaced by implementations
of RFC4120.  Which I expect to take quite some time...

-Martin

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 05 Aug 2005 19:21:10 +0200

>       RFC4120) (Status: PROPOSED STANDARD)

"Obsoleted by RFC4120" is not the same thing as "Status: HISTORIC".

---

From: Sam Hartman <[email-masked]>
Date: Tue, 09 Aug 2005 14:51:30 -0400

>>>>> "Martin" == Martin Rex <[email-masked]> writes:

    Martin> I think we should wait until the majority of the installed
    Martin> base of RFC1510 implementations have been replaced by
    Martin> implementations of RFC4120.  Which I expect to take quite
    Martin> some time...

Are you aware of any implementations that can better be described as
RFC 1510 implementations than RFC 4120 implementations?

I'm not sure that I am.

I don't think MIT Kerberos has ever had crypto primitives that
interoperate with what is described in RFC 1510.  I don't think what
RFC 1510 describes for non-DES encryption would work at all and by the
time implementations started supporting other enctypes they were
already closer to RFC 4120.

In particular I'd describe MIT Kerberos since version 1.1 (and
definetely since 1.2.5), most Heimdal versions, Windows XP and beyond
all as closer to RFC 4120 than 1510.  I'm not entirely sure how I
would characterize Windows 2000.

So, I agree with your comment, but I'm not sure I'm aware of any RFC
1510 implementations.

--Sam

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 10 Aug 2005 10:21:36 +0200

> RFC 1510 implementations than RFC 4120 implementations?

One thing that comes to mind is the NULL encryption type.  It is
described in RFC 1510, but not in RFC 4120 nor RFC 3961.  The NULL
encryption type is still needed to interoperate with some widely
deployed GSS-API implementations.

Thanks,
Simon

---

From: Sam Hartman <[email-masked]>
Date: Wed, 10 Aug 2005 09:36:13 -0400

>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:

    >>  Are you aware of any implementations that can better be
    >> described as RFC 1510 implementations than RFC 4120
    >> implementations?

    Simon> One thing that comes to mind is the NULL encryption type.
    Simon> It is described in RFC 1510, but not in RFC 4120 nor RFC
    Simon> 3961.  The NULL encryption type is still needed to
    Simon> interoperate with some widely deployed GSS-API
    Simon> implementations.

In krb_cred messages?  I believe RFC 4120 describes this at least for
that case.

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 10 Aug 2005 11:10:06 -0500

> In krb_cred messages?  I believe RFC 4120 describes this at least for

It might also be useful in the construction of exported credential
tokens.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Wed, 10 Aug 2005 13:41:16 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> It might also be useful in the construction of exported
    Nicolas> credential tokens.

It might, but 4120 does not permit this.  Arguing that using some
specific feature we decided against in the working group would be
useful does not seem like a good argument against moving 1510 to
historic.

(We may need to revisit this for exported credential tokens, but that
will be for a new spec).

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 10 Aug 2005 12:43:34 -0500

> useful does not seem like a good argument against moving 1510 to

I was not making such an argument.

> (We may need to revisit this for exported credential tokens, but that

Indeed.

---

From: Martin Rex <[email-masked]>
Date: Wed, 10 Aug 2005 21:02:03 +0200 (MET DST)

> RFC 1510 implementations than RFC 4120 implementations?

I admit I know little about both rfc1510 and rfc4120, and about the
status of various Implementations of Kerberos5 with respect to either
document.

I don't see any benefit to rush in the document to Historic.
From the standards point of view, the rfc1510 is described as "obsoleted"
by rfc4120, and that should be sufficient.

Once we have positive confirmation that all of
MIT Kerberos 1.0.x, Heimdal-0.4e, MS Win2K Kerberos SSP, DCE 1.1,
OpenVision/Veritas/Platinum/CA, Cybersafe and whatever the
various Unix Vendors have been shipping are fully in sync with 4120,
then we may think about moving rfc1510 to historic.
Given the age of the mentioned product (versions), I'm not sure.

It doesn't matter if the most recent versions of these implementations
are fully in sync with 4120, what matters here is the installed base.

Although rfc2743/2744 have been around for quite a while,
I don't see any necessity to move rfc1508/1509 to historic, either.

-Martin

---

From: Sam Hartman <[email-masked]>
Date: Wed, 10 Aug 2005 15:59:01 -0400

>>>>> "Martin" == Martin Rex <[email-masked]> writes:

    Martin> Once we have positive confirmation that all of MIT
    Martin> Kerberos 1.0.x, Heimdal-0.4e, MS Win2K Kerberos SSP, DCE
    Martin> 1.1, OpenVision/Veritas/Platinum/CA, Cybersafe and
    Martin> whatever the various Unix Vendors have been shipping are
    Martin> fully in sync with 4120, then we may think about moving
    Martin> rfc1510 to historic.  Given the age of the mentioned
    Martin> product (versions), I'm not sure.

Again, I think it is only required to show that these implementations
are closer to 4120 than 1510.  Also, I don't think many of those
implementations are in wide enough use to be a blocking issue.  I do
believe Heimdal 0.4e may still be in wide enough use to matter for
this discussion.
Also, I would like to remind you that  it is not a strict requirement that RFC 1510 not be in active use.  In particular I'd like to draw your attention to section 4.2.4 of RFC 2026:

4.2.4  Historic

   A specification that has been superseded by a more recent
      specification or is for any other reason considered to be obsolete is
         assigned to the "Historic" level.  (Purists have suggested that the
            word should be "Historical"; however, at this point the use of
               "Historic" is historical.)

I believe RFC 1510 meets that definition of historic.  In addition,
based on clarity issues, failure to describe implemented behavior and
limited security, I believe that RFc 1510 meets the definition of the
not recommended requirement level in section 3.3 of RFc 2026.

---

From: "D. R. Evans" <[email-masked]>
Date: Wed, 10 Aug 2005 14:39:41 -0600

Sam Hartman said the following at 08/10/2005 01:59 PM:-

> are closer to 4120 than 1510. 

Do people think that PacketCable is closer to 1510 or to 4120?

   Doc

-- 

-----------------------------------------------------------
Office: +1 303 494 0394
Mobile: +1 720 839 8462
Fax:    +1 781 240 0527
-----------------------------------------------------------