Subject: [Ietf-krb-wg] starttls

From: Sam Hartman <[email-masked]>
Date: Tue, 16 Jun 2009 11:28:41 -0400

I've reviewed the starttls draft again.  I support publication of the
current version of the draft on the informational or experimental
track.

I would prefer that the pre-authentication framework and FAST be the
IETF's recommended approach for securing Kerberos going forward.  I'm
not sure that we need two alternatives for this problem space and I
think that FAST provides a better solution than starttls.  So, I do
not prefer to publish starttls on the standards track--don't count me
as a supporter.

However I understand that my preference is a engineering preference.
Simon is using a different design esthetic in starttls and I can
easily understand why someone might prefer that esthetic.  Starttls
is definitely a simpler document than the pre-authentication framework.

I object to publishing the current version of starttls on the
standards track because of the certificate validation strategy.  There
is no mandatory-to-implement certificate type.  Rules are provided if
X.509 certificates are used, but clients and KDCs are not required to
implement support for X.509 certificates and these rules.  I fully
understand that some deployments do not lend themselves to certificate
validation.  However I think at least KDCs need to have a mandatory to
implement certificate type and clients need to have a
mandatory-to-implement validation rule if they support validation at
all.

If that were fixed, I'd be neutral on starttls on the standards track.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg