idnits 2.17.1 draft-ietf-krb-wg-kdc-model-16.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == The document seems to lack the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords. (The document does seem to have the reference to RFC 2119 which the ID-Checklist requires). -- The document seems to contain a disclaimer for pre-RFC5378 work, and may have content which was first submitted before 10 November 2008. The disclaimer is necessary when there are original authors that you have been unable to contact, or if some do not wish to grant the BCP78 rights to the IETF Trust. If you are able to get all authors (current and original) to grant those rights, you can and should remove the disclaimer; otherwise, the disclaimer is needed and you can ignore this comment. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (January 14, 2013) is 4121 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) No issues found here. Summary: 0 errors (**), 0 flaws (~~), 2 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 KERBEROS WORKING GROUP Johansson 3 Internet-Draft SUNET 4 Intended status: Standards Track January 14, 2013 5 Expires: July 18, 2013 7 An information model for Kerberos version 5 8 draft-ietf-krb-wg-kdc-model-16 10 Abstract 12 This document describes an information model for Kerberos version 5 13 from the point of view of an administrative service. There is no 14 standard for administrating a kerberos 5 KDC. This document 15 describes the services exposed by an administrative interface to a 16 KDC. 18 Status of this Memo 20 This Internet-Draft is submitted in full conformance with the 21 provisions of BCP 78 and BCP 79. 23 Internet-Drafts are working documents of the Internet Engineering 24 Task Force (IETF). Note that other groups may also distribute 25 working documents as Internet-Drafts. The list of current Internet- 26 Drafts is at http://datatracker.ietf.org/drafts/current/. 28 Internet-Drafts are draft documents valid for a maximum of six months 29 and may be updated, replaced, or obsoleted by other documents at any 30 time. It is inappropriate to use Internet-Drafts as reference 31 material or to cite them other than as "work in progress." 33 This Internet-Draft will expire on July 18, 2013. 35 Copyright Notice 37 Copyright (c) 2013 IETF Trust and the persons identified as the 38 document authors. All rights reserved. 40 This document is subject to BCP 78 and the IETF Trust's Legal 41 Provisions Relating to IETF Documents 42 (http://trustee.ietf.org/license-info) in effect on the date of 43 publication of this document. Please review these documents 44 carefully, as they describe your rights and restrictions with respect 45 to this document. Code Components extracted from this document must 46 include Simplified BSD License text as described in Section 4.e of 47 the Trust Legal Provisions and are provided without warranty as 48 described in the Simplified BSD License. 50 This document may contain material from IETF Documents or IETF 51 Contributions published or made publicly available before November 52 10, 2008. The person(s) controlling the copyright in some of this 53 material may not have granted the IETF Trust the right to allow 54 modifications of such material outside the IETF Standards Process. 55 Without obtaining an adequate license from the person(s) controlling 56 the copyright in such materials, this document may not be modified 57 outside the IETF Standards Process, and derivative works of it may 58 not be created outside the IETF Standards Process, except to format 59 it for publication as an RFC or to translate it into languages other 60 than English. 62 Table of Contents 64 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 65 2. Requirements notation . . . . . . . . . . . . . . . . . . . . 4 66 3. Information model demarcation . . . . . . . . . . . . . . . . 6 67 4. Information model specification . . . . . . . . . . . . . . . 7 68 4.1. Principal . . . . . . . . . . . . . . . . . . . . . . . . 7 69 4.1.1. Principal: Attributes . . . . . . . . . . . . . . . . 7 70 4.1.2. Principal: Associations . . . . . . . . . . . . . . . 8 71 4.2. KeySet . . . . . . . . . . . . . . . . . . . . . . . . . . 9 72 4.2.1. KeySet: Attributes . . . . . . . . . . . . . . . . . . 9 73 4.2.2. KeySet: Associations . . . . . . . . . . . . . . . . . 9 74 4.3. Key . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 75 4.3.1. Key: Attributes . . . . . . . . . . . . . . . . . . . 10 76 4.3.2. Key: Associations . . . . . . . . . . . . . . . . . . 10 77 4.3.3. Key: Remarks . . . . . . . . . . . . . . . . . . . . . 11 78 4.4. Policy . . . . . . . . . . . . . . . . . . . . . . . . . . 11 79 4.4.1. Policy: Attributes . . . . . . . . . . . . . . . . . . 11 80 4.4.2. Mandatory-to-implement Policy . . . . . . . . . . . . 12 81 5. Implementation Scenarios . . . . . . . . . . . . . . . . . . . 13 82 5.1. LDAP backend to KDC . . . . . . . . . . . . . . . . . . . 13 83 5.2. LDAP frontend to KDC . . . . . . . . . . . . . . . . . . . 13 84 5.3. SOAP . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 85 5.4. Netconf . . . . . . . . . . . . . . . . . . . . . . . . . 13 86 6. Security Considerations . . . . . . . . . . . . . . . . . . . 14 87 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15 88 8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 16 89 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 17 90 9.1. Normative References . . . . . . . . . . . . . . . . . . . 17 91 9.2. Informative References . . . . . . . . . . . . . . . . . . 17 92 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 18 94 1. Introduction 96 The Kerberos version 5 authentication service described in [RFC4120] 97 describes how a Key Distribution Center (KDC) provides authentication 98 to clients. The standard does not stipulate how a KDC is managed and 99 several "kadmin" servers have evolved. This document describes the 100 services required to administer a KDC and the underlying information 101 model assumed by a kadmin-type service. 103 The information model is written in terms of "attributes" and 104 "services" or "interfaces" but the use of these particular words must 105 not be taken to imply any particular modeling paradigm. Neither an 106 object oriented model nor an LDAP [RFC4510] schema is intended. The 107 author has attempted to describe in natural language the intended 108 semantics and syntax of the components of the model. An LDAP schema 109 (for instance) based on this model will be more precise in the 110 expression of the syntax while preserving the semantics of this 111 model. 113 Implementations of this document MAY decide to change the names used 114 (e.g. principalName). If so an implementation MUST provide a name to 115 name mapping to this document. In particular schema languages may 116 have different conventions for caseing, eg camelCase vs use of '_' 117 and '-' to separate 'words' in a name. Implementations MUST call out 118 such conventions explicitly. 120 Implementations of this document MUST be able to support default 121 values for attributes as well as the ability to specify syntax for 122 attribute values. 124 2. Requirements notation 126 This document uses the standard key words ("MUST", "MUST NOT", 127 "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", 128 "RECOMMENDED", "MAY", and "OPTIONAL") that are defined in [RFC2119] 129 but with modifications to those definitions as described below. The 130 reason for this (which was discussed extensively in the kerberos WG) 131 is as follows: 133 This document describes an information model for kerberos 5 but does 134 not directly describe any mapping onto a particular schema- or 135 modelling language. Hence an implementation of this model consists 136 of a mapping to such a language - e.g. an LDAP or SQL schema. The 137 standard normative key word therefore require precise definition: 139 The terms MUST or REQUIRED means that schema implementing this model 140 must have a way to represent a feature (i.e that it is mandatory to 141 implement in schema) but that unless otherwise specified the feature 142 may represent an optional element in the chosen schema definition 143 language. 145 However MUST also means that a KDC or administrative interface 146 implementing this information model MUST provide the feature and 147 associated behavior consistent with schema. 149 For instance, principalLastFailedAuthentication (cf below) represents 150 the last time an authentication failed for a principal. In an LDAP 151 schema (for instance) this may be represented as an optional 152 attribute even though all KDCs implementing this specification must 153 support this attribute. 155 The terms MAY or OPTIONAL means that the feature is optional to 156 implement by a KDC or administrative interface implementing this 157 information model. It also means that the feature is optional to 158 implement in schema. 160 Implementors of schema should be aware that unless there is a way to 161 represent critical but optional elements in the schema definition 162 language confusion may arise when optional elements are used but not 163 understood by all implementations in a particular deployment. 165 The expression "MUST NOT be OPTIONAL" means that a feature is 166 mandatory to implement ("MUST" cf above) and that additionally it 167 must not be marked optional in the schema language. In particular 168 this means that the feature is both mandatory to implement and must 169 be present in all representations of the object to which it applies. 171 The term SHOULD or RECOMMENDED means that the consequences of not 172 implementing the feature as if it was described with the "MUST" 173 keyword must be carefully weighed before choosing a different course. 174 In particular this implies that interoperability concerns may arise 175 from not following the recommended practice in schema that implements 176 this model. 178 The context will determine if the "SHOULD" key word applies to 179 schema, or to underlying behaviour of the KDC or both. For instance, 180 principalIsDisabled (cf below) SHOULD default to FALSE implies both a 181 recommendation for the behaviour of KDCs aswell as a rekommendation 182 for the representation of that behaviour in schema. 184 3. Information model demarcation 186 The information model specified in the next chapter describes 187 objects, properties of those objects and relations between those 188 objects. These elements comprise an abstract view of the data 189 represented in a KDC. It is important to understand that the 190 information model is not a schema. In particular the way objects are 191 compared for equality beyond that which is implied by the 192 specification of a syntax is not part of this specification. Nor is 193 ordering specified between elements of a particular syntax. 195 Further work on Kerberos will undoubtedly prompt updates to this 196 information model to reflect changes in the functions performed by 197 the KDC. Such extensions to the information model should always use 198 a normative reference to the relevant RFCs detailing the change in 199 KDC function. 201 This model describes a number of elements related to password policy 202 management. Not all of the elements in this model are unique to 203 Kerberos; an LDAP implementation of this model should incorporate 204 existing LDAP schema where functional overlap exists, rather than 205 defining additional Kerberos-specific elements. 207 4. Information model specification 209 4.1. Principal 211 The fundamental entity stored in a KDC is the principal. The 212 Principal is associated to keys and generalizes the "user" concept. 213 The Principal MUST be implemented in full and MUST NOT be OPTIONAL in 214 an implementation 216 4.1.1. Principal: Attributes 218 4.1.1.1. principalName 220 The principalName MUST uniquely identify the Principal within the 221 administrative context of the KDC. The principalName MUST be 222 equivalent to the string representation of the Principal name 223 (section 2.1.1 of [RFC1964]) including, if applicable for the name 224 type, the realm. 226 The attribute MAY be multi-valued if the implementation supports 227 aliases and/or enterprise names. In that case exactly one of the 228 principalName values MAY be designated the canonical principalName 229 and if the implementation supports enctypes which require salt then 230 exactly one of the values of principalName MAY be designated as the 231 canonical salting principalName. 233 Implementations (i.e. schema) that support enterprise names and/or 234 aliases SHOULD provide for efficient lookup of Principal objects 235 based on alias/enterprise name. 237 4.1.1.2. principalNotUsedBefore 239 The Principal MUST NOT be used before this date. The syntax of the 240 attribute MUST be Internet Date/Time Format from [RFC3339]. The 241 attribute MUST be single-valued. 243 4.1.1.3. principalNotUsedAfter 245 The Principal MUST NOT be used after this date. The syntax of the 246 attribute MUST be Internet Date/Time Format from [RFC3339]. The 247 attribute MUST be single-valued. 249 4.1.1.4. principalIsDisabled 251 A boolean attribute used to disable a Principal. The attribute 252 SHOULD default to boolean FALSE. 254 4.1.1.5. principalLastCredentialChangeTime 256 This single-valued attribute contains the time of the last successful 257 change of credential (e.g. password or private key) associated with 258 this Principal. The syntax of the attribute MUST be Internet Date/ 259 Time Format from [RFC3339]. 261 4.1.1.6. principalCreateTime 263 This single-valued attribute contains the time and date when this 264 Principal was created. The syntax of the attribute MUST be Internet 265 Date/Time Format from [RFC3339]. 267 4.1.1.7. principalModifyTime 269 This single-valued attribute contains the time and date when this 270 Principal was last modified excluding credentials change. The syntax 271 of the attribute MUST be Internet Date/Time Format from [RFC3339]. 273 4.1.1.8. principalMaximumTicketLifetime 275 This single-valued attribute contains the time in seconds 276 representing the maximum lifetime for tickets issued for this 277 Principal. 279 4.1.1.9. principalMaximumRenewableTicketLifetime 281 This single-valued attribute contains the delta time in seconds 282 representing the maximum amount of time a ticket may be renewed for 283 this Principal. 285 4.1.1.10. principalAllowedEnctype 287 This OPTIONAL multi-valued attribute lists the enctypes allowed for 288 this principal. If empty or absent any enctype supported by the 289 implementation is allowed for this Principal. 291 This attribute is intended as a policy attribute and restricts all 292 uses of enctypes including server, client, and session keys. Data 293 models MAY choose to use policy objects in order to represent more 294 complex decision mechanisms. 296 4.1.2. Principal: Associations 298 Each Principal MAY be associated with 0 or more KeySet and MAY be 299 associated with 0 or more Policies. The KeySet is represented as an 300 object in this model since it has attributes associated with it (the 301 key version number). In typical situations the Principal is 302 associated with exactly 1 KeySet but implementations MUST NOT assume 303 this case, i.e. an implementation of this standard MUST be able to 304 handle the general case of multiple KeySet associated with each 305 principal. Multiple KeySets may for instance be useful when 306 performing a key rollover for a principal. 308 4.2. KeySet 310 In Kerberos principals are associated with zero or more symmetric 311 secret keys, and each key has a key version number (kvno) and 312 enctype. In this model we group keys by kvno into KeySet objects. A 313 Principal can have zero or more KeySet objects associated with it, 314 each of which MUST have one or more keys. Each KeySet is associated 315 with exactly one principal. Schemas derived from this model MAY lack 316 a direct analogue of KeySet as described in this document. 318 It is expected that most Kerberos implementations will use a special- 319 purpose interface for setting and changing Principal passwords and 320 keys. 322 If a server supports an enctype for a Principal that enctype must be 323 present in at least one key for the Principal in question. For any 324 given enctype a KeySet MUST NOT contain more than one Key with that 325 enctype. 327 The security of Kerberos 5 depends absolutely on the confidentiality 328 and integrity of the Key objects stored in the KDC. Implementations 329 of this standard MUST facilitate, to the extent possible, an 330 administrator's ability to place more restrictive access controls on 331 KeySets than on other Principal data, and to arrange for more secure 332 backup for KeySets. 334 4.2.1. KeySet: Attributes 336 4.2.1.1. kvno 338 Also knowns as the key version number. This is a single-valued 339 attribute containing a non-negative integer. This number is 340 incremembed by one each time a key in the KeySet is changed. 342 4.2.2. KeySet: Associations 344 To each KeySet MUST be associated a set of 1 or more Keys. 346 4.3. Key 348 Implementations of this model MUST NOT REQUIRE keys to be 349 represented. 351 4.3.1. Key: Attributes 353 4.3.1.1. keyEncryptionType 355 The enctype SHOULD be represented as an enumeration of the enctypes 356 supported by the KDC using the string name ("encryption type") of the 357 enctype from the IANA registry of Kerberos Encryption Type Numbers. 358 One example is 'aes128-cts-hmac-sha1-96'. 360 4.3.1.2. keyValue 362 The binary representation of the key data. This MUST be a single- 363 valued octet string. 365 4.3.1.3. keySaltValue 367 The binary representation of the key salt. This MUST be a single- 368 valued octet string. 370 4.3.1.4. keyStringToKeyParameter 372 This MUST be a single-valued octet string representing an opaque 373 parameter associated with the enctype. This parameter is specified 374 in the "string-to-key" method in section 3 of [RFC3961]. 376 4.3.1.5. keyNotUsedBefore 378 This key MUST NOT be used before this date. The syntax of the 379 attribute MUST be semantically equivalent with the standard ISO date 380 format. This MUST be a single-valued attribute. 382 4.3.1.6. keyNotUsedAfter 384 This key MUST NOT be used after this date. The syntax of the 385 attribute MUST be semantically equivalent with the standard ISO date 386 format. This MUST be a single-valued attribute. 388 4.3.1.7. keyIsDisabled 390 This is a boolean attribute which SHOULD be set to false by default. 391 If this attribute is true the key MUST NOT be used. This is used to 392 temporarily disable a key. 394 4.3.2. Key: Associations 396 None 398 4.3.3. Key: Remarks 400 The security of the keys is an absolute requirement for the operation 401 of Kerberos 5. If keys are implemented adequate protection from 402 unauthorized modification and disclosure MUST be available and 403 REQUIRED by the implementation. 405 4.4. Policy 407 Implementations SHOULD implement policy but MAY allow them to be 408 OPTIONAL. The Policy should be thought of as a 'typed hole'. i.e. an 409 opaque binary value paired with an identifier of type of data 410 contained in the binary value. Both attributes (type and value) must 411 be present. 413 4.4.1. Policy: Attributes 415 4.4.1.1. policyIdentifier 417 The policyIdentifier MUST be globally unique. Possible types of 418 identifiers include: 420 An Object Identifier (OID) [RFC4517] 422 A URI [RFC3986] 424 A UUID [RFC4122] 426 Implementations of this specification are expected to assign globally 427 unique identifiers to the list of standard policy below in accordance 428 with best-practice for identifier-management for the schema-language 429 used. 431 4.4.1.2. policyIsCritical 433 This boolean attribute indicates that the KDC MUST be able to 434 correctly interpret and apply this policy for the Principal to be 435 used. 437 4.4.1.3. policyContent 439 This is an optional single opaque binary value used to store a 440 representation of the policy. In general a policy cannot be fully 441 expressed using attribute-value pairs. The policyContent is OPTIONAL 442 in the sense that an implementation MAY use it to store an opaque 443 value for those policy-types which are not directly representable in 444 that implementation. 446 4.4.1.4. policyUse 448 This is an optional single enumerated string value used to describe 449 the use of the policy. Implementations SHOULD provide this attribute 450 and MUST (if the attribute is implemented) describe the enumerated 451 set of possible values. The intent is that this attribute be useful 452 in providing an initial context-based filtering. 454 4.4.2. Mandatory-to-implement Policy 456 All implementations that represent Policy objects MUST be able to 457 represent the policies listed in this section. Implementations are 458 not required to use the same underlying data-representation for the 459 policyContent binary value but SHOULD use the same OIDs as the 460 policyIdentifier. In general the expression of policy may require a 461 Turing-complete language. This specification does not attempt to 462 model policy expression language. 464 4.4.2.1. Password Quality Policy 466 Password quality policy controls the requirements placed by the KDC 467 on new passwords. 469 4.4.2.2. Password Management Policy 471 Password management policy controls how passwords are changed. 473 4.4.2.3. Keying Policy 475 A keying policy specifies the association of enctypes with new 476 principals, e.g. when a Principal is created one of the applicable 477 keying policies is used to determine the set of keys to associate 478 with the principal. 480 4.4.2.4. Ticket Flag Policy 482 A ticket flag policy specifies the ticket flags allowed for tickets 483 issued for a principal. 485 5. Implementation Scenarios 487 There are several ways to implement an administrative service for 488 Kerberos 5 based on this information model. In this section we list 489 a few of them. 491 5.1. LDAP backend to KDC 493 Given an LDAP schema implementation of this information model it 494 would be possible to build an administrative service by back-ending 495 the KDC to a directory server where principals and keys are stored. 496 Using the security mechanisms available on the directory server keys 497 are protected from access by anyone apart from the KDC. 498 Administration of the principals, policy, and other non-key data is 499 done through the directory server while the keys are modified using 500 the set/change password protocol 501 [I-D.ietf-krb-wg-kerberos-set-passwd]. 503 5.2. LDAP frontend to KDC 505 An alternative way to provide a directory interface to the KDC is to 506 implement an LDAP-frontend to the KDC which exposes all non-key 507 objects as entries and attributes. As in the example above all keys 508 are modified using the set/change password protocol 509 [I-D.ietf-krb-wg-kerberos-set-passwd]. In this scenario the 510 implementation would typically not use a traditional LDAP 511 implementation but treat LDAP as an access protocol to data in the 512 native KDC database. 514 5.3. SOAP 516 Given an XML schema implementation of this information model it would 517 be possible to build a SOAP interface to the KDC. This demonstrates 518 the value of creating an abstract information model which is mappable 519 to multiple schema representations. 521 5.4. Netconf 523 Given a YAML implementation of this information model it would be 524 possible to create a Netconf-based interface to the KDC, enabling 525 management of the KDC from standard network management applications. 527 6. Security Considerations 529 This document describes an abstract information model for Kerberos 5. 530 The Kerberos 5 protocol depends on the security of the keys stored in 531 the KDC. The model described here assumes that keys MUST NOT be 532 transported in the clear over the network and furthermore that keys 533 are treated as write-only attributes that SHALL only be modified 534 (using the administrative interface) by the change-password protocol 535 [I-D.ietf-krb-wg-kerberos-set-passwd]. 537 Exposing the object model of a KDC typically implies that objects can 538 be modified and/or deleted. In a KDC not all principals are created 539 equal, so that for instance deleting krbtgt/EXAMPLE.COM@EXAMPLE.COM 540 effectively disables the EXAMPLE.COM realm. Hence access control is 541 paramount to the security of any implementation. This document does 542 not mandate access control. This only implies that access control is 543 beyond the scope of the standard information model, i.e. that access 544 control may not be accessible via any protocol based on this model. 545 If access control objects are exposed via an extension to this model 546 the presence of access control may in itself provide points of attack 547 by giving away information about principals with elevated rights etc. 549 7. IANA Considerations 551 This document has no IANA actions. 553 8. Acknowledgments 555 The author wishes to extend his thanks to Love Hoernquist-Aestrand 556 and Sam Hartman for their important contributions to this document. 558 9. References 560 9.1. Normative References 562 [RFC1964] Linn, J., "The Kerberos Version 5 GSS-API Mechanism", 563 RFC 1964, June 1996. 565 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 566 Requirement Levels", BCP 14, RFC 2119, March 1997. 568 [RFC3339] Klyne, G., Ed. and C. Newman, "Date and Time on the 569 Internet: Timestamps", RFC 3339, July 2002. 571 [RFC3961] Raeburn, K., "Encryption and Checksum Specifications for 572 Kerberos 5", RFC 3961, February 2005. 574 [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform 575 Resource Identifier (URI): Generic Syntax", STD 66, 576 RFC 3986, January 2005. 578 [RFC4120] Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The 579 Kerberos Network Authentication Service (V5)", RFC 4120, 580 July 2005. 582 [RFC4122] Leach, P., Mealling, M., and R. Salz, "A Universally 583 Unique IDentifier (UUID) URN Namespace", RFC 4122, 584 July 2005. 586 [RFC4517] Legg, S., "Lightweight Directory Access Protocol (LDAP): 587 Syntaxes and Matching Rules", RFC 4517, June 2006. 589 9.2. Informative References 591 [I-D.ietf-krb-wg-kerberos-set-passwd] 592 Williams, N., "Kerberos Set/Change Key/Password Protocol 593 Version 2", draft-ietf-krb-wg-kerberos-set-passwd-08 (work 594 in progress), November 2008. 596 [RFC4510] Zeilenga, K., "Lightweight Directory Access Protocol 597 (LDAP): Technical Specification Road Map", RFC 4510, 598 June 2006. 600 Author's Address 602 Leif Johansson 603 Swedish University Network 604 Thulegatan 11 605 Stockholm 607 Email: leifj@sunet.se 608 URI: http://www.sunet.se