Subject: Re: Q: Conflict between TSIG RFC and GSS-API documents

From: "Kevin J. Dunlap" <[email-masked]>
Date: Sat, 01 Feb 2003 12:26:30 -0800

As the implementor that found the problem that placed the lock 
on the GSS-API document, I belive that the lock should be removed 
once the TSIG RFC has the appropriate modifications made to allow
the GSS-TSIG draft to advance.  I don't think we should advance a
Draft that is not in compliance with the RFC it is ment to enhance.

-Kevin

Your message dated: Fri, 31 Jan 2003 14:36:24 EST
> From the minutes in ATLANTA:
>
>
>>GSSAPI and TSIG conflict:
>>     DNSEXT wg generated TSIG RFC
>>     DNSEXT wg processed gssapi TSIG
>>         just before rfc editor started 48hour period we got a report
>>         that there was a conflict between two the documents.
>>         TSIG specifies that TSIG can only be used if original query
>>           contains TSIG
>>         GSSAPI specifies that last message in TKEY exchange has TSIG
>>           last message is empty, and this proves the key negotiated is
>>           working from security point of view this is a good thing
>>
>>         TSIG needs minor updates before advancing to draft standard:
>>              is this extensions one of them?
>>
>>The sense of the room was that this was a reasonable extensions and the
>>chair is instructed to take this question to the mailing list.
>
>Does the mailing list agree with this assessment and give
>its consensus that the lock on the GSS-API document be lifted ?
>
>Silence will be taken as agreement.
>
>Please post objections before Feb 12'th.
>
>thanks
>         Olafur
>
>
>
>
>--
>to unsubscribe send a message to [email-masked] with
>the word 'unsubscribe' in a single line as the message text body.
>archive: <http://ops.ietf.org/lists/namedroppers/>
>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Sat, 01 Feb 2003 21:57:47 +0000

> Draft that is not in compliance with the RFC it is ment to enhance.

procedurally, there's also the option of adding an "Amends:" header
to the gss-tsig rfc, and putting in a paragraph that says "for the
purpose of gss-tsig, the following restriction in the original tsig
rfc is relaxed."  that seems like the easiest, fastest solution.

---

From: Erik Nordmark <[email-masked]>
Date: Fri, 7 Feb 2003 13:42:44 +0100 (CET)

> Although I agree with that assessment, that doesn't mean that I think 
> it is a good idea to thaw the GSS-API document.  I think it should be 
> thawed in tandem with a document that proscribes the needed 
> improvement to the TSIG base.  I.e., a document specifying an 
> extension to TSIG's base is needed before allowing an extension that 
> would otherwise be in conflict.

Would it be acceptable to add text to the GSS-TSIG document to make it
clear that it updates the TSIG RFC? 
I can see that it is desirable
to get this change applied to the TSIG spec, but in the interim I think
the best is to get it documented somewhere. And having rfc-index.txt indicate
that there is an update to the TSIG document helps people find this.

Comments?

  Erik

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 10 Feb 2003 09:30:52 +0100 (CET)

> I would ask that the GSS-TSIG document not only say that it updates 
> the TSIG spec but that the document also contains the suggested 
> change to the TSIG document.  This is the approach followed in other 
> DNSSEC documents.

That was what I meant (but failed to explicitly say).

  Erik

---

From: Edward Lewis <[email-masked]>
Date: Mon, 10 Feb 2003 07:48:16 -0700

okey-dokey.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer