Kitten and Kerberos WG Merger - New Charter
Shawn Emery <[email protected]> Fri, 04 Jan 2013 01:44:29 -0700
| Newsgroups | gmane.ietf.kitten,gmane.ietf.krb-wg |
|---|---|
| Message-ID | <50E6966D.9040704__49484.1541782536$1357289172$gmane$org@oracle.com> |
This is a multi-part message in MIME format.
--------------080305030202030106050005
Content-Type: multipart/alternative;
boundary="------------010909030206020607050400"
--------------010909030206020607050400
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Attached is the proposed charter for the merged Kitten and Kerberos
working groups. We request feed-back from each of the work items in
regards to, if the work is a:
Good idea?
Bad idea?
Would you be a major contributor?
Would you be a reviewer of work?
In addition, we are requesting feed-back on work items to be included
that are not currently covered by the draft charter text.
For those that have existing work items or have already volunteered to
contribute to new work, please review and provide feedback on the
milestones section.
Please provide any feedback to the list before 1/18/13. Thank you.
Shawn.
--
kitten/krb-wg co-chair
--------------010909030206020607050400
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font size="+1"><tt><br>
Attached is the proposed charter for the merged Kitten and
Kerberos working groups. We request feed-back from each of the
work items in regards to, if the work is a:<br>
<br>
Good idea?<br>
Bad idea?<br>
Would you be a major contributor?<br>
Would you be a reviewer of work?<br>
<br>
In addition, we are requesting feed-back on work items to be
included that are not currently covered by the draft charter
text.<br>
<br>
For those that have existing work items or have already
volunteered to contribute to new work, please review and provide
feedback on the milestones section.<br>
<br>
Please provide any feedback to the list before 1/18/13. Thank
you.<br>
<br>
Shawn.<br>
-- <br>
kitten/krb-wg co-chair<br>
</tt></font>
</body>
</html>
--------------010909030206020607050400--
--------------080305030202030106050005
Content-Type: text/plain;
name="kitten-charter.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="kitten-charter.txt"
Common Authentication Technology Next Generation (kitten)
---------------------------------------------------------
Charter
Current Status: Active
Chairs:
Sam Hartman <[email protected]>
Shawn Emery <[email protected]>
Josh Howlett <[email protected]>
Secretary:
Simon Josefsson <[email protected]>
Security Area Directors:
Stephen Farrell <[email protected]>
Sean Turner <[email protected]>
Security Area Advisor:
Stephen Farrell <[email protected]>
Mailing Lists:
General Discussion: [email protected]
To Subscribe: https://www.ietf.org/mailman/listinfo/kitten
Archive: http://www.ietf.org/mail-archive/web/kitten/current/maillist.html
Description of Working Group:
The purpose of the Common Authentication Technology Next Generation
(Kitten) working group (WG) is to develop extensions/improvements to the
GSS-API and to the Kerberos authentication system, shepherd specific
GSS-API security mechanisms, and provide guidance for any new
SASL-related submissions.
This charter subsumes the Kerberos WG under the auspices of the kitten WG.
Therefore the following charter text contains both kitten and Kerberos WG items.
The working group will develop extensions and/or updates to the GSS-API,
working on specific items regarding credential management, replay cache
avoidance, error reporting, and supporting stateless and/or distributed
acceptors.
The working group will also maintain and improve upon the Kerberos
protocol, working on items regarding internationalization, new initial
authentication types, authorization framework/data, replay cache
avoidance, cryptography advances, interop with 3rd party authentication,
and identity management.
In detail, both existing and new work items include:
Existing Working Group Items
---------------------------
SASL Mechanism for OAuth (draft-ietf-kitten-sasl-oauth)
SASL Mechansim for SAML-EC (draft-ietf-kitten-sasl-saml-ec)
GSS-API IANA Registry (draft-ietf-kitten-gssapi-extensions-iana)
KDC Model (draft-ietf-krb-wg-kdc-model)
PKINIT Hash Agility (draft-ietf-krb-wg-pkinit-alg-agility)
Kerberos IANA Registry (draft-ietf-kitten-kerberos-iana-registries)
Initial and Pass Through Authentication in Kerberos 5 (draft-ietf-krb-wg-iakerb)
Unencrypted Portion of Ticket Extensions (draft-ietf-krb-wg-ticket-extensions)
GSS-API Related
---------------
Provide new interfaces for credential management, which include the
following:
initializing credentials
iterating credentials
exporting/importing credentials
Negotiable replay cache avoidance
Define interfaces for better error message reporting.
Specify an option for exporting partially-established security
contexts and possibly a utility function for exporting security
contexts in an encrypted form, as well as a corresponding utility
function to decrypt and import such security context tokens.
Specify one-time password / two-factor authentication needs for SASL
applications. This could be achieved through an explicit new
GSS-API/SASL mechanism (e.g.,
http://tools.ietf.org/html/draft-josefsson-kitten-crotp-00) or if
the consensus is that due to usability reasons, it is preferable to do
OTP/2FA through an higher level protocol
(Kerberos/OpenID/SAML/SAML20EC/EAP?) then prepare a document explaining
the usability problem and provide pointers for implementers.
Kerberos Related
----------------
Prepare and advance one or more standards-track specifications which
update the Kerberos version 5 protocol to support non-ASCII principal
and realm names, salt strings, and passwords, and localized error
reporting. Maximizing backward compatibility is strongly desired.
Prepare, review, and advance standards-track and informational
specifications defining new authorization data types for carrying
supplemental information about the client to which a Kerberos ticket
has been issued and/or restrictions on what the ticket can be used
for. To enhance this ongoing authorization data work, a container
format supporting the use cases of draft-ietf-krb-wg-pad may be
standardized.
Prepare a standards-track protocol to solve the use cases addressed
by draft-hotz-kx509-01 including new support for digital signatures.
Today Kerberos requires a replay cache to be used in AP exchanges in
almost all cases. Replay caches are quite complex to implement
correctly, particularly in clustered systems. High-performance replay
caches are even more difficult to implement. The WG will pursue
extensions to minimize the need for replay caching, optimize replay
caching, and/or elide the need for replay caching.
Prepare, review, and advance standards-track and informational
specifications defining use of new cryptographic algorithms in the
Kerberos protocol using the RFC3961 framework, on an ongoing basis.
Cryptographic algorithms intended for standards track status must be of
good quality, have broad international support, and fill a definite need.
Prepare, review, and advance standards-track and informational
specifications of new pre-authentication types for the Kerberos
protocol, on an ongoing basis.
Prepare, review, and advance standards track updates and extensions to RFC4121,
as needed and on an ongoing basis.
Goals and Milestones
--------------------
Jan 2013 draft-ietf-kitten-sasl-oauth to IESG
Jan 2013 draft-ietf-krb-wg-kdc-model to IESG
Feb 2013 draft-ietf-krb-wg-pkinit-alg-agility to IESG
Feb 2013 draft-ietf-kitten-sasl-saml-ec to IESG
Mar 2013 draft-ietf-krb-wg-iakerb to IESG
Mar 2013 draft-ietf-kitten-gssapi-extensions-iana to IESG
Apr 2013 draft-ietf-krb-wg-cammac to IESG
Apr 2013 draft-ietf-kitten-kerberos-iana-registries to IESG
May 2013 draft-ietf-krb-wg-pad to IESG
May 2013 Adopt work on one or more items for GSS-API cred management
Jun 2013 Adopt work on better error reporting in the GSS-API
Jun 2013 Adopt work on exporting partially-established GSS-API contexts
Jul 2013 draft-ietf-krb-wg-ticket-extensions to IESG
Jul 2013 Adopt work on the GSS-API for replay cache avoidance
--------------080305030202030106050005
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Kitten mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/kitten
--------------080305030202030106050005--