Subject: Re: [Ietf-krb-wg] kdc-model: Separation of KeySets

From: Sam Hartman <[email-masked]>
Date: Thu, 01 Apr 2010 09:37:55 -0400

My opinion in ranked order:

1) Greg's revisions
2) current text
3) Simo's revisions.
4) None of the above

Greg's text does a better job of handling the backup issue by hinting
that one of the important ways of controlling authorization to backups
is actually separation of some kind.  Simo's text implies to me at least
that you'd just have some sort of ACL in your backup system, where as
Greg's text implies you might encrypt under different keys or use
separate media.

However I think it is important to realize that there is a wide variety
in what people will do.  Most people will just backup their keys along
side everything else; for many environments that's fine.  We're simply
trying to facilitate more secure deployments being possible for those
who need them.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Thomas Hardjono <[email-masked]>
Date: Thu, 1 Apr 2010 09:50:37 -0400

> -----Original Message-----
> From: [email-masked] [mailto:ietf-krb-wg-
> [email-masked]] On Behalf Of Jeffrey Hutzelman
> Sent: Wednesday, March 31, 2010 3:06 PM
> To: Henry B. Hotz; Greg Hudson
> Cc: [email-masked]; Sam Hartman; [email-masked]
> Subject: Re: [Ietf-krb-wg] kdc-model: Separation of KeySets
> 
> --On Wednesday, March 31, 2010 11:04:42 AM -0700 "Henry B. Hotz"
> <[email-masked]> wrote:
> 
> >
> > On Mar 31, 2010, at 9:43 AM, Greg Hudson wrote:
> >
> >> I feel a little weird saying "MUST facilitate," but the concept being
> >> expressed here is a little vague.
> >
> >
> > MUST restrict (protect?) access to KeySet data.
> >
> > MAY allow less restrictive access to other data.
> 
> We're getting ahead of ourselves here.  This is a data model document, not
> a schema document.  Implementations of this document are schemas, and the
> goal was to REQUIRE schemas to separate KeySet and other data sufficiently
> well that an implementation of the schema would give the administrator the
> flexibility to do so operationally.  I think we've been trying to avoid, in
> this document, defining requirements for implementations of schemas based
> on it.

I'm following this thread and have to agree with Jeff.  This is an Information Model document. Why are we talking about key protection, access control, etc. etc. in this doc?

/thomas/

---

From: Leif Johansson <[email-masked]>
Date: Mon, 05 Apr 2010 12:44:08 +0200

> trying to facilitate more secure deployments being possible for those

I agree with Sam. I like Gregs revision. I'm in favor of adopting that
version.

	Cheers Leif

---

From: Leif Johansson <[email-masked]>
Date: Fri, 09 Apr 2010 10:54:34 +0200

> My opinion in ranked order:

I'm on record (I believe) agreeing with this and since there has been
no vocal opposition and since the last-call is about to expire I'm
going to affect the change Greg suggested as part of the last-call 
corrections.

I'll send out a post-WGLC-version of the model (-08) shortly after
the last-call expires and ask the chair to send it to the IESG.

	Cheers Leif