###################### DRAFT ##### DRAFT ##### DRAFT ######################
##  NB: These minutes are so-far incomplete and are missing a number of  ##
##  details, but are being uploaded anyway on the theory that partial    ##
##  information is better than none.  Further updates are expected with  ##
##  the missing details in the near future.  -- Jeff                     ##
###################### DRAFT ##### DRAFT ##### DRAFT ######################

Kerberos Working Group - IETF 73 meeting minutes (DRAFT 00)


The chairs began by reviewing the status of several documents that are
currently working their way through the process or have advanced since
the last meeting:

 - ECC for PKINIT has been published as RFC 5349

 - After long delays, the PROTO review and writeup on the cross-realm
   problem statement document was completed and the document has been
   given to Tim to take to the IESG.

 - Also after long delays, the set-change password document has recently
   been revised to reflect issues raised during PROTO review.  Another
   revision is still needed to fix a few remaining issues, and then the
   document will be sent to the IESG.

 - The GSS-API Hash Agility document has completed WGLC and Larry is
   currently reviewing it and preparing his PROTO writeup.

 - The One-Time Password document has also completed WGLC.  Larry has
   done his PROTO writeup and posted a list of issues he found, some
   of which will require input from the WG.  Once the issues are resolved,
   Larry will do his writeup; however, this document cannot go to the
   IESG before the preauthentication framework document is done.


Three additional documents were discussed, for which working group last
calls have at least started, and for which some issues must be resolved
before the documents can proceed.

 - The data model document is currently in its second WGLC, which will
   expire on December 5.  Leif said there was a WGLC comment from Love
   saying that we should state this is a partial model.  There was also
   another comment from Love, saying that the concepts of principal and
   principal keys were not something you could infer from the Kerberos
   core specifications.  Leif agrees this is correct, but doesn't see
   that as a problem; the point of this document is to define a model
   for KDC's and administration and not to describe things from the POV
   of a client.  He proposes to write up an introductory sentence to
   address the former, and possibly another to address the latter.

   There was then considerable discussion on the question of client vs
   server principals, and princpal name aliases, much of which occurred
   in the Jabber room.  Some of this discussion will be continued on the 
   mailing list.

 - We discussed the remaining open issue in Anonymous, which is the
   question of whether we need a standard way for GSS-API initiators to
   request the use of so-called "partially-anonymous" credentials, which
   name the client's realm but not its principal name.  There did not
   seem to be anyone clamoring to do so now; Sam Hartman argued that we
   should defer doing so until there is, provided that deferral doesn't
   cause any harm.  There was very little discussion, but no argument
   that standardization is necessary at this time; the sense of the room
   seemed to be that doing so was not necessary.  [[ This lack of interest
   was later confirmed by a consensus call on the mailing list.  --jhutz ]]

 - We discussed two issues Larry found during his review of OTP.  The
   first is that when using an anonymous channel, the client may have
   a chance to validate channel bindings or may get that chance too late
   to prevent an attacker from obtaining the OTP value.  Larry asks that
   the WG consider whether we should require that OTP be used only over
   an authenticated channel, or allow some subset of OTP mechanisms to
   be used over an unauthenticated channel, when they are judged safe
   to use in that context.
   
   Sam argues that OTP over an unauthenticated channel is valuable, even
   though it may be vulnerable to a man-in-the-middle attack, and so the
   spec should support that.  He had no opinion on what the default should
   be.  After additional discussion, the sense of those particpating in
   the discussion seemed to be that use of an unauthenticated channel
   should be supported, but that requiring authentication should be the
   default, at least for event-based OTP mechanisms.

   The second issue Larry raised was the question as to whether we should
   define additional specific error codes to describe problems with the
   OTP process.  Tom Yu raised the question of whether these codes would
   be intended for consumption by software, like PREAUTH_REQUIRED, or for
   humans.  Larry indicated he was mostly thinking about humans.  Tom
   wonders if it's more useful to provide such information in human-readable
   form; Jeffrey Hutzelman complained about KRB_ERR_GENERIC and asked for
   not repeating that case.  After some discussion, it was clear that there
   was no consensus in the room, and the discussion would be continued on
   the mailing list.


The working group discussed Love Hörnquist-Åstrand's request that we adopt
his ticket extensions document.  The chairs believe this work falls within
the scope of our charter, as part of the development of a Kerberos protocol
which enables future protocol revisions and extensions.  There was some
discussion regarding the question of whether both of the described extension
methods were necessary, which will be continued on the WG list.

Jeffrey Hutzelman, Nicolas Williams, Tom Yu, Steve Buckley, Jeff Schiller,
Ken Raeburn, and Larry Zhu all expressed support for adopting this work,
and there was no opposition.  The chairs found the sense of the room to be
in favor of adopting the work.

The chairs then presented a fairly agressive proposal for new milestones.
This proposal included 7 milestones for documents to enter WGLC or be sent
to the IESG in December, 2008, plus finishing preauth and STARTTLS in
January, OTP in February (due to its dependence on preauth), and Referrals
and the LDAP schema document in March.

 - The December milestones refer mostly to documents which are already
   done or nearly done, and were adopted as-is, except the milestone for
   the data model document, which was set in February to give the document
   author time to respond to comments raised during last call.  Tim Polk
   commented that the IESG is running extra telechats in December and
   January, and we should take advantage of the bandwidth by getting
   documents done before the end of the year.

 - Leif proposed that the LDAP schema milestone be dropped, as he believed
   the document would be of little practical value, and there is no one to
   work on it.  There were no objections, and Tim said it would be OK to
   drop this milestone even though there is a charter item.  As a result,
   the milestone will be dropped and the work item will probably not appear
   on the next charter.

 - There was some discussion on the status of starttls.  Sam raised the
   concern that much of the delay has been due to lameness on the part of
   the chairs particularly Jeff, and particularly that the chairs' proposed
   milestone to issue a WGLC on this document in January would result in
   pressure to make a quick decision after a long period of chair-induced
   delay.  Jeff indicated that he would go back and review previous
   comments and provide a summary to the WG this week, and that there would
   _not_ be pressure to make a decision without sufficient information and
   discussion simply to meet an artificial milestone.

   [[ Further discussion on jabber resulted in a proposal to publish    ]]
   [[ both STARTTLS and FAST as informational documents, and later to   ]]
   [[ upgrade one of them to standards track if/when we decide which    ]]
   [[ should be a standard or which should be REQUIRED in Kerberos 5.3. ]]
   [[ This proposal has since been taken to the mailing list, and will  ]]
   [[ be discussed there.  Depending on the result of that discussion,  ]]
   [[ the question of previous comments may turn out to be moot.        ]]

  - Updated milestones for referrals and the preauth framework will
    require further discussion with the authors of those documents.


During the open mic session, Shoichi Sakane gave an update on the status of
his document defining a DHCPv6 option for Kerberos.  The document has been
rewritten based on previous input from the WG, and the author would like
comments on this version.  Last meeting, Shoichi agreed to explain on the
mailing list why such an option was necessary; the chairs asked whether
this had generated any support in KRB-WG, whether this work could be done
in DHC, and what was needed from KRB-WG.  Shoichi said he presented the
work in DHC and was asked to get input and requirements from KRB-WG.  He
said if KRB-WG sees no further problems, he'll take it to DHC.  The chairs
said they believed it would be OK to do so or as an individual document,
and that there was no conflict with existing krb-wg work.

Sam Hartman asked about the current structure of the option.  He raised
the concern that the current document still does not allow KDC's to be
specified for more than one realm.

[[ Post-meeting discussion with the DHC chairs indicated the normal     ]]
[[ process is for DHCP option work to be done in a WG having expertise  ]]
[[ in what the option does, and review in DHC for DHCP protocol issues. ]]
[[ For KRB-WG to adopt this document would require a charter update.    ]]
[[ The chairs will raise on the mailing list the question of whether    ]]
[[ we should update our charter to include this work and adopt the      ]]
[[ document.                                                            ]]