Subject: [Ietf-krb-wg] Question: Prefer to block on draft-ietf-krb-wg-kdc-model

From: Sam Hartman <[email-masked]>
Date: Wed, 27 Jun 2012 09:52:51 -0400

Hi.
At this point in the process, there's a presumption that absent
consensus to change, the text currently in the draft will survive.

Unfortunately, we're in an annoying situation. I think we have a rough
consensus that the text in the draft is not what we want. I think Simo,
Nico, Leif, Sam and Jeff have indicated a desire to make changes. I
think Tom and Greg may also have indicated such a desire.
The presumption of consensus evaporates.

However, so far, we're not reaching rough consensus on any particular
change.

As chair, I need to ask: Would you prefer to block (possibly
indefinitely) on this issue rather than publishing as-is?  For this, one
word answers drawn from the set {yes, no} are preferred.  You can
explain, but I do need to poll the WG about whether this is worth
blocking the document.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Leif Johansson <[email-masked]>
Date: Thu, 28 Jun 2012 09:11:46 +0200

On 06/27/2012 03:52 PM, Sam Hartman wrote:
> 
> 
> Hi. At this point in the process, there's a presumption that
> absent consensus to change, the text currently in the draft will
> survive.
> 
> Unfortunately, we're in an annoying situation. I think we have a
> rough consensus that the text in the draft is not what we want. I
> think Simo, Nico, Leif, Sam and Jeff have indicated a desire to
> make changes. I think Tom and Greg may also have indicated such a
> desire. The presumption of consensus evaporates.
> 
> However, so far, we're not reaching rough consensus on any
> particular change.
> 
> indefinitely) on this issue rather than publishing as-is?  For
> this, one word answers drawn from the set {yes, no} are preferred.
> You can explain, but I do need to poll the WG about whether this is
> worth blocking the document.

I prefer not to block.

---

From: Greg Hudson <[email-masked]>
Date: Thu, 28 Jun 2012 11:06:01 -0400

On 06/27/2012 09:52 AM, Sam Hartman wrote:
> indefinitely) on this issue rather than publishing as-is?

I'd prefer to block, since I don't think it would mean blocking
indefinitely.  I think we can, at a minimum, achieve rough consensus
that marking 4.1.1.5-7 as optional is better than the current state.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tom Yu <[email-masked]>
Date: Thu, 28 Jun 2012 11:09:07 -0400

> explain, but I do need to poll the WG about whether this is worth

I have a slight preference for blocking.

I'm still reviewing the discussion, but it seems that from what I've
read so far, the minimal change that I would be comfortable with (and
that we might reach consensus about) is removing the debated
attributes altogether.  We could easily add them back in a subsequent
version.  I dislike adding things that we know that people are very
likely not going implement in the way we specified.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nico Williams <[email-masked]>
Date: Thu, 28 Jun 2012 10:18:21 -0500

> explain, but I do need to poll the WG about whether this is worth

Block.  Or fix.  But do not publish as-is.  I'd be happy with removal
of the N-strikes-related attributes as a fix, and any related text.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Thu, 28 Jun 2012 11:44:16 -0400

>>>>> "Nico" == Nico Williams <[email-masked]> writes:

    Nico> Block.  Or fix.  But do not publish as-is.  I'd be happy with removal
    Nico> of the N-strikes-related attributes as a fix, and any related text.

What attributes do you see as related to n-strikes?
As an individual I actually don't see any.
I see attributes that mostly seem to date back to things in the MIT
schema since before they had lockout, plus an attribute (failed auth
count) that we're quite certain is useless for n-strikes in its current
form.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nico Williams <[email-masked]>
Date: Thu, 28 Jun 2012 12:01:33 -0500

> As an individual I actually don't see any.

To be precise I want the following attributes to be made explicitly
optional, or better: removed:

4.1.1.5.  principalNumberOfFailedAuthenticationAttempts
4.1.1.6.  principalLastFailedAuthentication
4.1.1.7.  principalLastSuccessfulAuthentication

I'd be OK with adding a locked attribute.

Nico

---

From: Leif Johansson <[email-masked]>
Date: Thu, 28 Jun 2012 20:35:09 +0200

On 06/28/2012 07:01 PM, Nico Williams wrote:
>> Nico> Block.  Or fix.  But do not publish as-is.  I'd be happy
>> with removal Nico> of the N-strikes-related attributes as a fix,
>> and any related text.
>> 
>> What attributes do you see as related to n-strikes? As an
>> individual I actually don't see any.
> 
> To be precise I want the following attributes to be made
> explicitly optional, or better: removed:
> 
> 4.1.1.5.  principalNumberOfFailedAuthenticationAttempts 4.1.1.6.
> principalLastFailedAuthentication 4.1.1.7.
> principalLastSuccessfulAuthentication
> 

I'm ok removing them or making them optional. I believe that
introducing locking will entail a substantial rewrite of the
spec which I think is not worth the effort at this point. Maybe
next revision!

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 28 Jun 2012 14:33:03 -0400

On Thu, 2012-06-28 at 12:01 -0500, Nico Williams wrote:
> >    Nico> Block.  Or fix.  But do not publish as-is.

Agree.

> I'd be OK with adding a locked attribute.

Agree.

---

From: Sam Hartman <[email-masked]>
Date: Thu, 28 Jun 2012 15:01:30 -0400

OK.  I *think* that everyone can live with removing the attributes and
making no other changes.

1) Is there anyone who objects strongly to that?

2) does anyone see a set of changes they personally would prefer to
removing the attributes that they think might be able to gain consensus?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nico Williams <[email-masked]>
Date: Thu, 28 Jun 2012 14:22:12 -0500

> spec which I think is not worth the effort at this point. Maybe

I'm talking about a locked attribute with no special semantics to read
nor write.  It'd be deleting the principal to lock and re-creating the
principal to unlock, say, or deleting its keys and re-creating them,
or setting a disallow-tix flag, only, of course, simpler than that.
Speaking of which, I don't see that MIT krb5 attribute in the I-D
(disallow-tix).

Nico

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 28 Jun 2012 16:19:36 -0400

> Speaking of which, I don't see that MIT krb5 attribute in the I-D

It's 4.1.1.4, principalIsDisabled

---

From: Nico Williams <[email-masked]>
Date: Thu, 28 Jun 2012 15:47:49 -0500

> It's 4.1.1.4, principalIsDisabled

That's what I get for not having done a case-insensitive search.

OK, so I'm for removing 4.1.1.5, 4.1.1.6, and 4.1.1.7.

Nico

---

From: Simo Sorce <[email-masked]>
Date: Fri, 29 Jun 2012 08:44:15 -0400

> OK.  I *think* that everyone can live with removing the attributes and

Sorry for being late, I was traveling this week.

> 1) Is there anyone who objects strongly to that?

I think the current proposal is better than the previous text.

> removing the attributes that they think might be able to gain consensus?

I am not opposed to retaining them if made optional, but I have no
strong preference between making them optional and just removing them.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York