Subject: krb-wg summary from IETF 63

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 04 Aug 2005 12:52:29 +0200

Kerberos Working Group - IETF 63 meeting summary

- The chairs gave an update of the status of documents which
  have been sent to the IESG, and of ongoing work:

  + Kerberos clarifications - published as RFC4120
  + The GSSAPI-CFX document - published as RFC4121
  + PKINIT - close to done; 2 issues will be discussed today
  + OCSP-for-PKINIT - done; will be ballotted with PKINIT
  + RFC1510ter - not much progress
  + Referrals - authors think it is nearly ready for WGLC
  + Enctype-Nego - needs updates from last call comments
  + Set/Change PW - author thinks last issue is resolved

- There was a long discussion on ticket #837, related to identifying
  KDC certificates.  The sense of the room was that my message of July 18
  correctly summarized the problem, and correctly described what appears
  in pkinit-26 and -27.

  The current document specifies the use of the KerberosPrincipalName SAN
  with the principal name of the TGS (krbtgt/REALM@REALM) to identify a
  certificate for use with PKINIT and belonging to a particluar realm's
  KDC(s).  The sense of the room was to keep this method and to keep it
  as the REQUIRED method for both usage and naming.

  The sense of the room was that no other naming methods needed to be
  specified, but that clients should be permitted to accept certificates
  with other names based on local policy (also permitted by -27).  There
  was much contention on the issue of whether an EKU should be required
  in this case, and, if not, whether it should be specified at all; this
  question remained unresolved.

- Andre Scedrov (UPenn) and Aaron Jaggard (Tulane) have been doing formal
  analysis of Kerberos protocols, and gave a presentation on a problem
  they found in PKINIT in RSA mode.  They described two approaches which
  they believe would fix the problem.  One involves having the KDC sign
  the AS-REQ; the other involves having it sign the client's identity.
  The former approach is essentially what Larry has proposed in pkinit-27,
  and they believe that will fix the problem.

  After some discussion, there was general agreement that the approach
  taken by pkinit-27 was acceptable, and to a certain extent even preferred.

  Love objected to the use of a keyed checksum which was sitting right
  along side its key (both in a structure signed by the KDC); it was pointed
  out that the use of a keyed checksum allowed us to use RFC3961 cksumtypes,
  which essentially come only in keyed variants.

  It was pointed out that ASN.1 comments are not the best place to have the
  only copy of a normative requirement (wrt the client.  The editor will
  fix this.

- Sam Hartman gave some brief comments on some assumptions currently made
  in Kerberos which he would like to see go away.  Unfortunately, there
  was not time for significant discussion; we will likely see the full
  version of this presentation in Vancouver.

- There will be an interim meeting September 19,20 at Microsoft for the
  purpose of doing work needed to advance RFC's 3961, 3962, and 4121 to
  draft standard.  Details will be posted to the list.

DECISIONS (to be validated):
  * Specify KerberosPrincipalName SAN with the TGS principal name as a way
    of identifying KDC certificates, and make it the REQUIRED method.
  * PKINIT-27's approach to the binding problem is acceptable

ACTION ITEMS:
  * chair: consensus call on set/change pw direction (from Minneapolis)
  * WG: Resolve the PKINIT EKU issue
  * nico: update and submit set/change pw
  * chair: last call set/change pw when ready
  * chair: last call referrals when ready
  * chair: get secdir review on pkinit
  * chair: last call pkinit when ready