Subject: WG Action: RECHARTER: Kerberos (krb-wg)

From: IESG Secretary <[email-masked]>
Date: Mon, 23 Jul 2007 13:15:01 -0400

The charter of the Kerberos (krb-wg) working group in the Security Area
of the IETF has been updated. For additional information, please contact
the Area Directors or the working group Chairs.

+++

Kerberos (krb-wg)
===================

Current Status: Active Working Group

Chair(s):
Jeffrey Hutzelman <[email-masked]>
Larry Zhu <[email-masked]>

Security Area Director(s):
Tim Polk <[email-masked]>
Sam Hartman <[email-masked]>

Security Area Advisor
Sam Hartman <[email-masked]>

Mailing Lists:
General Discussion: [email-masked]
To Subscribe: [email-masked]
In Body: subscribe ietf-krb-wg your_email_address
Archive: ftp://ftp.ietf.org/ietf-mail-archive/krb-wg/

Description of Working Group:

Kerberos over the years has been ported to virtually every operating
system. There are at least two open source versions, with numerous
commercial versions based on these and other proprietary implementations.
Kerberos evolution has continued in recent years, with the development
of a new crypto framework, publication of a new version of the Kerberos
specification, support for initial authentication using public keys, and
numerous extensions developed in and out of the IETF.

However, wider deployment and advances in technology bring with them both
new challenges and new opportunities, particularly with regard to making
initial authentication of users to the Kerberos system both convenient
and secure. In addition, several key features remain undefined.

The Kerberos Working Group will continue to improve the core Kerberos
specification, develop extensions to address new needs and technologies
related to improving the process of client authentication, and produce
specifications for missing functionality.

Specifically, the Working Group will:

* Complete existing work:
- ECC for PKINIT (draft-zhu-pkinit-ecc-03.txt)
- Set/Change Password 
(draft-ietf-krb-wg-kerberos-set-passwd-05.txt)
- Naming Constraints (draft-ietf-krb-wg-naming-02.txt)
- Anonymity (draft-ietf-krb-wg-anon-03.txt)
- Hash agility for GSS-KRB5 
(draft-ietf-krb-wg-gss-cb-hash-agility-00.txt)
- Hash agility for PKINIT (draft-ietf-krb-wg-pkinit-alg-agility-01.txt)
- Referrals (draft-ietf-krb-wg-kerberos-referrals-08.txt)

* Prepare and advance a specification for an updated, backward-compatible
version of the Kerberos version 5 protocol which supports non-ASCII
principal and realm names, salt strings, and passwords; insures that
those portions of the protocol which are not encrypted are nonetheless
authenticated whenever possible; and enables future protocol revisions
and extensions.

* Develop extensions which reduce or eliminate exposure of Kerberos
clients' long-term keys to attack and enable the use of alternate
mechanisms for initial authentication. This task will comprise the
following items:
- A model and framework for preauthentication mechanisms
- A mechanism for providing a protected channel for carrying
preauthentication data and/or a reply key between a Kerberos
client and KDC, within the KDC_REQ/KDC_REP exchange.
- Support for One-Time Passwords
- Support for hardware authentication tokens
- Support for using TLS to secure communications with Kerberos KDCs.

* Examine issues related to the current cross-realm model, produce a
list of problems to be solved, and evaluate approaches to solving them.

* Develop extensions to Kerberos and a GSS-API mechanism (IAKERB) to
enable Kerberos clients to communicate with a KDC by using a GSS-API
acceptor as a proxy.

* Produce a data model for information needed by the KDC, and an LDAP
schema for management of that data.

Goals and Milestones:

--DONE-- TCP Extensibility to IESG
JUL 2007 ECC for PKINIT to IESG
JUL 2007 Set/Change Password to IESG

JUL 2007 Naming Constraints to IESG
JUL 2007 Anonymity to IESG
JUL 2007 Hash agility for GSS-KRB5 to IESG
JUL 2007 Hash agility for PKINIT to IESG

JUL 2007 WGLC on STARTTLS
JUL 2007 WGLC on Referrals

AUG 2007 WGLC on data model
AUG 2007 Choose direction for Kerberos v5.3

SEP 2007 WGLC on preauth framework
SEP 2007 WGLC on cross-realm issues

NOV 2007 WGLC on OTP
NOV 2007 WGLC on hardware preauth

MAR 2008 WGLC on Kerberos v5.3
MAR 2008 WGLC on IAKERB
MAR 2008 WGLC on LDAP schema

---

From: Sam Hartman <[email-masked]>
Date: Mon, 23 Jul 2007 17:21:06 -0400

Folks, it appears the IESG made an error in approving this charter.

In particular, while we requested that the charter go out for external
review and community comment, that appears to have never happened.

The IESG is figuring out how we want to move forward.  The obvious approach is to withdraw the new charter and request community input.

It's certain that whatever we do we will seek community input and will
treat the community input as if it had been received before the
charter was sent out.

At least we didn't accidentally close the WG; that's happened before too.:-)

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 30 Jul 2007 12:01:03 -0400 (EDT)

> the Area Directors or the working group Chairs.

Note that this is a copy of the original message sent last week, when the
IESG inadvertently approved a charter for which it had intended to request
public comment.  It appears that some outside entity is taking it upon
itself to process the 'CC' headers on messages to ietf-announce, resulting
in (delayed) duplicate messages to anyone on the CC line.

The charter has not yet been approved, and the public comment period
continues until tomorrow, Tuesday, July 31, 2007.  Comments should be sent
to the IESG at [email-masked].

-- Jeff