Subject: [Ietf-krb-wg] I-D Action:draft-ietf-krb-wg-preauth-framework-17.txt

From: [email-masked]
Date: Tue, 22 Jun 2010 14:15:01 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Kerberos Working Group of the IETF.

	Title           : A Generalized Framework for Kerberos Pre-Authentication
	Author(s)       : S. Hartman, L. Zhu
	Filename        : draft-ietf-krb-wg-preauth-framework-17.txt
	Pages           : 52
	Date            : 2010-06-22

Kerberos is a protocol for verifying the identity of principals
(e.g., a workstation user or a network server) on an open network.
The Kerberos protocol provides a facility called pre-authentication.
Pre-authentication mechanisms can use this facility to extend the
Kerberos protocol and prove the identity of a principal.

This document describes a more formal model for this facility.  The
model describes what state in the Kerberos request a pre-
authentication mechanism is likely to change.  It also describes how
multiple pre-authentication mechanisms used in the same request will
interact.

This document also provides common tools needed by multiple pre-
authentication mechanisms.  One of these tools is a secure channel
between the client and the key distribution center with a reply key
strengthening mechanism; this secure channel can be used to protect
the authentication exchange thus eliminate offline dictionary
attacks.  With these tools, it is relatively straightforward to chain
multiple authentication mechanisms, utilize a different key
management system, or support a new key agreement algorithm.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-preauth-framework-17.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Wed, 23 Jun 2010 13:33:25 -0400

This draft resolves IESG concerns.
The non-editorial changes have been copied to the list and with the
exception of my proposed resolution to Russ's discuss comments did not
draw a reaction.

Together, Nico, Jeff and I worked on text for Russ's discuss.  By the
time we were done, I think we were all happier with the result than with
my starting text.  That discussion also took place on the list.

Russ has cleared, so I think we're ready for this draft to be approved
as soon as Tim reviews the changes.

We do have a normative reference problem: this draft depends on
draft-ietf-krb-wg-anon.  Larry, Jeff and I are working to resolve that
issue.  It will require a WGLC and IETF LC.  Hopefully we can be in the
middle of that process by IETF 78.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg