Subject: Submission of draft-ietf-cat-kerberos-set-passwd-06.txt to IESG

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 18 Jun 2001 09:56:28 -0500

The Kerberos Working Group of the Security Area would like to submit

   "Kerberos Set/Change Password: Version 2"
  http://www.ietf.org/internet-drafts/draft-ietf-cat-kerberos-set-passwd-06.txt

to the IESG. 

The draft has under gone two Working Group Last Calls. 

During the first last call was made between 5/2 - 5/17 as 
<draft-ietf-cat-kerberos-set-passwd-05.txt> a number of comments where 
made and a summary of these is attached. These where all addressed,
and a new draft was submitted. In particular, the ASN.1 was rewritten
to only use a subset if ASN.1 as used in RFC 1510. 

During the second last call was from 6/1 - 6/15 as 
<draft-ietf-cat-kerberos-set-passwd-06.txt> no comments where received,
leading the chair to conclude that all the previous comments where addressed
and the draft should proceed to the IESG. 

-------- Original Message --------
Subject: Close of Working Group Last call - draft-ietf-cat-kerberos-set-passwd-05.txt
Date: Fri, 18 May 2001 09:10:30 -0500
From: "Douglas E. Engert" <[email-masked]>
To: [email-masked]
References: <[email-masked]> <[email-masked]>

The two week period for the WG last call of draft-ietf-cat-kerberos-set-passwd-05.txt
has ended. 

There has been quite a bit of discussion, most in the last three day. There appears
to be a number of outstanding technical questions, which leads the chair to conclude
that there is NOT consensus to move this draft forward at this time. 

But with some work these issues could be resolved, and we could have another
last call prior to London. 

I would like to try an summarize the issues:

   o ASN.1 or not. I heard a lot of grumbling, but no real technical opposition.
     The introduction of CHOICE was the biggest complaint, so I would like to 
     ask it there is any way to remove this. Could there be two separate message types?
     Could the two choices be listed as optional, but with the stipulation that
     one and only one should be present? i.e. can we kept the ASN.1 constructs
     to the subset of ASN.1 used in 1510? 

   o The BER/DER encoding rules need to be specified. DER is what is specified in 1510
     so there appears to be agreement on DER. 

   o Should the password be UTF8? Sounds like it should. 

   o Ken Raeburn had many good comments about salt type, entropy and choice of 
     the kadmin/setpw principal name. All of these need to be addressed.

   o Tom Yu also had many good comments about the ASN.1, and the flag bits. These
     need to be addressed, and as Tom suggested, kept compatible with 1510.

   o Tom's comments on the use of the subsession key and questioning the ability
     of the client to generate keys needs to be addressed. 

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444