Subject: RE: complex extensions attacking IETF protocols

From: Peter Ford <[email-masked]>
Date: Fri, 6 Nov 1998 23:10:36 -0800

Ted,

The use of Kerberos in IKE complies with the Kerberos spec.  I suspect there
will be interoperable implementations, but I have no idea whether they will
be Open Source or not.  Microsoft and the IETF should probably leave that
decision up to the implementors.  NT 5.0 also supports PK/IKE and that
interoperability has been demonstrated at the last 2 (3?) IPSEC bakeoffs.
If someone, or one of many implementations, can not interoperate with one of
those IKE mechanisms with NT 5.0, they can use a static key as mandated in
the IPSEC architecture.  

peter

-----Original Message-----
From: Theodore Y. Ts'o [mailto:[email-masked]]
Sent: Friday, November 06, 1998 11:39 AM
To: Peter Ford
Cc: 'Robert Moskowitz'; [email-masked]
Subject: Re: complex extensions attacking IETF protocols

   From: Peter Ford <[email-masked]>
   Date: Thu, 5 Nov 1998 21:30:14 -0800 

   Is it the use of Kerberos for authentication that you find "proprietary"
or
   the use of IKE?

How about the propietary extensions to Kerberos which will either be
documented "sometime after Beta 2 ships", or "maybe we won't do publish
them after all", depending on who you talk to at Microsoft?

Adding propietary extensions to open protocols and then not releasing
the specifications for said propietary extensions is certainly a great
way to lock out open source implementations.  It's a perfect example of
what I call "embrace and engulf".

						- Ted

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Tue, 10 Nov 1998 02:22:20 GMT

From: Peter Ford <[email-masked]>
   Date: Fri, 6 Nov 1998 23:10:36 -0800 

The complex extension I was referring to was the PAC found in the
Kerberos ticket, which is a propietary extension which has not been
documented by Microsoft.  It's not specific to IKE, per se.  So I was
commenting on the fact that Microsoft chose to add a propietary,
non-documented extension to Kerberos was certainly a great way of
preventing any other competing implementation --- including the Open
Source referencement implementation from MIT --- from even having the
choice of whether or not to implement said propietary extension.

Microsoft has been extremely wishy-washy about whether or not they would
release the format of this propietary extension.  After I wrote an
article in ;login denouncing this practice, I was told by Peter
Brundrett that of course said extension would be documented, "sometime
after beta 2".  Now I'm hearing rumblings of beta 3 about to be shipped,
and it's still not been documented, and I've heard other reports from
people who have heard Microsoft personnel (Dave Thompson, at LISA-NT
'98) saying that maybe they wouldn't release the format of the
propietary PAC after all.

This kind of propietary extensions to open protocols which are not
documented sometimes until much after the Microsoft release (and
sometimes never), is most unfortunate.  And certainly Kerberos isn't the
only protocol where Microsoft has engaged in this practice --- PPP, DNS,
Telnet AUTH NTLM, also come to mind.  

Indeed, the one exception to this has been the use of Kerberos in IKE,
which was documented in an Internet-Draft early on, and I do applaud
Microsoft's willingness to do this.  We should certainly give credit
where credit is due.  I only wish that this was the rule, and not the
exception.

						- Ted

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Tue, 10 Nov 1998 02:22:20 GMT

- Ted