Subject: [Ietf-krb-wg] I-D Action:draft-ietf-krb-wg-otp-preauth-11.txt

From: [email-masked]
Date: Fri, 9 Oct 2009 09:15:01 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Kerberos Working Group of the IETF.

	Title           : OTP Pre-authentication
	Author(s)       : G. Richards
	Filename        : draft-ietf-krb-wg-otp-preauth-11.txt
	Pages           : 38
	Date            : 2009-10-09

The Kerberos protocol provides a framework authenticating a client
using the exchange of pre-authentication data.  This document
describes the use of this framework to carry out One Time Password
(OTP) authentication.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-otp-preauth-11.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: <[email-masked]>
Date: Mon, 12 Oct 2009 06:46:01 -0400

The updated version of the OTP pre-auth draft has all the changes
discussed on list apart from in-line PIN change.

1) Added full tagging to the ASN.1
This is to be consistent with RFC4021

2) Clarified the text regarding the meaning of otp-service

3) Clarified text regarding the use of the client nonce in the OTP hash

4) Removed the references to RFC3244 regarding PIN change

5) Added PIN format field to the PA-OTP-PIN-CHANGE

6) Altered the use of KerberosFlags so that bit 0 is not used

7) Made the PA-OTP-CHALLENGE contain a sequence of OTP-KEY-INFO
structures for each token This is to support a user who has multiple
tokens and so allow the KDC to return information on each of those
tokens.

8) Added otp-vendor to the OTP-KEYINFO returned by PA-OTP-CHALLENGE

9) Added the pin-required and pin-not-required flags to the
PA-OTP-CHALLENGE This was requested to allow a client could alter its
behaviour depending on whether a particular token requires a PIN

10) Removed the etype from the PA-OTP-CHALLENGE This was the value
returned to the client to let it know how to encrypt the returned nonce.

11) Updated the samples

12) Clarified that the requested ticket should be returned when a
PA-OTP-PIN-CHANGE is returned unless user PIN change is required

13) Added a "mandatory" flag to the PA-OTP-PIN-CHANGE The KDC can return
a PA-OTP-PIN-CHANGE to the client in three different situations
a) When the token's PIN has expired and must be changed
b) When the token's PIN has been changed and the new PIN is being sent
to the user
c) To inform the client about when the PIN will expire

The "mandatory" flag was to allow the client to distinguish between
cases 1 and 3.  

14) Recommended the use of authorization data to carry token context in
the returned PIN-change service ticket

15) Clarrified the text in section 3.2 to make it clear that the
PA-OTP-CHALLENGE is returned encrytped in a FAST pa-data type

16) Added the must-encrypt-nonce flag to the PA-OTP-CHALLENGE to
restrict the use of s/key type systems when kdc-authentication is not
provided by another means

17) Added text to the security considerations outlining the possible
risk of relying on host key armor for kdc-authentication 
 
--Gareth

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> [email-masked]
> Sent: 09 October 2009 17:15
> To: [email-masked]
> Cc: [email-masked]
> Subject: [Ietf-krb-wg] I-D Action:draft-ietf-krb-wg-otp-preauth-11.txt
> 
> The Kerberos protocol provides a framework authenticating a 
> client using the exchange of pre-authentication data.  This 
> document describes the use of this framework to carry out One 
> Time Password
> (OTP) authentication.
> 
> Below is the data which will enable a MIME compliant mail 
> reader implementation to automatically retrieve the ASCII 
> version of the Internet-Draft.
>