Subject: Re: Call for agenda items

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 16 Jul 2007 13:56:08 -0400 (EDT)

On Thu, 28 Jun 2007, Shoichi Sakane wrote:

> Hi Jeff,
>
> > IETF 69 is coming up sooner than you think, and it is time to start
> > putting together an agenda.  Ideally, I would like to spend time on...
>
> > If anyone has specific items they'd like to discuss, now would be a good
> > time to mention them.
>
> Though it already has gone by a month since you asked it to the group,
> I would like to put an agenda item if you can still accept it.

Sorry for the delay in responding.  The cross-realm problems document is
definitely on our agenda for next week.

-- Jeff

---

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 16 Jul 2007 15:18:27 -0500

Jeff,
I would like to get on the agenda for few minutes to drum up interest
in adding "Level of Assurance" information to the TGT, base on NIST-800-63.

-- 

  Douglas E. Engert  <[email-masked]>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444

---

From: Sam Hartman <[email-masked]>
Date: Tue, 17 Jul 2007 12:29:14 -0400

>>>>> "Douglas" == Douglas E Engert <[email-masked]> writes:

    Douglas> Jeff, I would like to get on the agenda for few minutes
    Douglas> to drum up interest in adding "Level of Assurance"
    Douglas> information to the TGT, base on NIST-800-63.

Doug have you read section 6.6 of draft-ietf-krb-preauth-framework?

I realize this is not quite what you are looking for, but I wonder if
something more along these lines would be easier to get consensus
behind than something NIST specific?

---

From: "Douglas E. Engert" <[email-masked]>
Date: Tue, 17 Jul 2007 14:48:17 -0500

> behind than something NIST specific?

Yes, thats not quite it. But it does not have to be NIST specific either.

For example with PKINIT the applicaiton server may wish to base it trust
on the user's certificate. So one possible way to do this is to pass the
certificate chain to the application server. This might make the ticket
quite large, and so another way if for the KDC or KDC plugin to derive
a "level of assurance" lossly based on NIST-63, but defined in a RFC and
add this to the ticket.

As I had said in earlier e-mail, there is one large oraganization that
that this is missing from PKINIT.

--

---

From: Larry Zhu <[email-masked]>
Date: Tue, 17 Jul 2007 13:35:43 -0700

The question is whether this effort can be folded into the preauth
framework effort. If we can, it is the fastest and easiest to address
the need here.

--larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Douglas E.
Engert
Sent: Tuesday, July 17, 2007 12:48 PM
To: Sam Hartman
Cc: Jeffrey Hutzelman; [email-masked]
Subject: Re: Call for agenda items

> behind than something NIST specific?

Yes, thats not quite it. But it does not have to be NIST specific
either.

--

---

From: "Paul Rabinovich" <[email-masked]>
Date: Tue, 17 Jul 2007 17:19:19 -0400

Larry,

	In my view the problem is not Kerberos-specific and should be
solved as such. Kerberos WG could provide Kerberos bindings/encodings
for the generic solution. One possible seed for the actual solution is
the work on Authentication Contexts in SAML 2.0 done by OASIS. My
feeling is that it doesn't fully address the issue (although it provides
an extension mechanism) but it may be a good start.

	My 2c,
	PR

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Larry Zhu
Sent: Tuesday, July 17, 2007 4:36 PM
To: Douglas E. Engert; Sam Hartman
Cc: Jeffrey Hutzelman; [email-masked]
Subject: RE: Call for agenda items

--larry

-----Original Message-----

--