Subject: [Ietf-krb-wg] Proposed changes to draft-ietf-krb-wg-clear-text-cred

From: Sam Hartman <[email-masked]>
Date: Mon, 19 Sep 2011 12:02:50 -0400

Hi.  Jari thought that section 4 is unclear. He trusts us to clarify it
and so he cleared his discuss, but we should clarify both to honor that
trust and because he's right that it's a bit confusing.

I propose the following clarification:

old (section 4):

   The Kerberos Encryption Type 0 is an invalid value [RFC3961].  Layers
      above the encryption layer are left to interpret its use in their own
         context specific manner.  The use of encryption type 0 in the
	    unencrypted form of the KRB-CRED is not to specify an encryption

new: The Kerberos Encryption Type 0 is an invalid value [RFC3961].
   This means that no RFC 3961 encryption type with value 0 will ever
   be defined; no encryption or key management operations will use
   this value. Layers above the encryption layer often transport
   encryption types as integer values. These layers are free to use a
   0 in an encryption type integer as a flag or sentinal value or for
   other context-specific purposes. For example, section 3 of this
   specification defines the semantics of a 0 carried in the krb_cred
   message's encryption type field.

Also, in the security considerations section:

old:
end-to-end security

new: mutual authentication

Rationale:

1) Russ Housley filed a discuss that we require mutual authentication;
he's right and we need to say that.  

2) I don't know what the ends are
inherently, the Kerberos KDC protocol can provide hop-by-hop rather
than end-to-end security, and I see nothing different about the
security assumptions here from the base Kerberos security assumptions.

If the authors are OK with these changes and no one objects in a day or two we can publish a new draft and get this one approved!
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Russell J Yount <[email-masked]>
Date: Mon, 19 Sep 2011 17:11:50 +0000

Sam,

One small issue: s/krb_cred/KRB-CRED/

Other than that, this looks good. You have my approval.

-Russ

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Sam Hartman
Sent: Monday, September 19, 2011 12:03 PM
To: [email-masked]
Cc: [email-masked]
Subject: [Ietf-krb-wg] Proposed changes to draft-ietf-krb-wg-clear-text-cred

old (section 4):

old:
end-to-end security

Rationale:

---

From: Sam Hartman <[email-masked]>
Date: Mon, 19 Sep 2011 13:17:14 -0400

>>>>> "Russell" == Russell J Yount <[email-masked]> writes:

    Russell> Sam, One small issue: s/krb_cred/KRB-CRED/

    Russell> Other than that, this looks good. You have my approval.

Well, you'll be doing the work:-)
If you don't see any objections in a couple of days please submit a new
version with the correction.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg