From owner-ietf-kink@mail.vpnc.org Mon Feb 11 18:01:30 2002 Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA20039 for ; Mon, 11 Feb 2002 18:01:29 -0500 (EST) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id g1BMmJS08937 for ietf-kink-bks; Mon, 11 Feb 2002 14:48:19 -0800 (PST) Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by above.proper.com (8.11.6/8.11.3) with ESMTP id g1BMmF308932 for ; Mon, 11 Feb 2002 14:48:15 -0800 (PST) Received: from grand-central-station.mit.edu (GRAND-CENTRAL-STATION.MIT.EDU [18.7.21.82]) by pacific-carrier-annex.mit.edu (8.9.2/8.9.2) with ESMTP id RAA07517; Mon, 11 Feb 2002 17:48:17 -0500 (EST) Received: from melbourne-city-street.mit.edu (MELBOURNE-CITY-STREET.MIT.EDU [18.7.21.86]) by grand-central-station.mit.edu (8.9.2/8.9.2) with ESMTP id RAA02278; Mon, 11 Feb 2002 17:48:16 -0500 (EST) Received: from kikki.mit.edu (KIKKI.MIT.EDU [18.18.1.142]) by melbourne-city-street.mit.edu (8.9.2/8.9.2) with ESMTP id RAA03230; Mon, 11 Feb 2002 17:48:15 -0500 (EST) Received: (from warlord@localhost) by kikki.mit.edu (8.9.3) id RAA22422; Mon, 11 Feb 2002 17:48:15 -0500 (EST) To: mat@cisco.com Cc: ietf-kink@vpnc.org From: Derek Atkins Subject: KINK draft wrap-up Date: 11 Feb 2002 17:48:14 -0500 Message-ID: Lines: 17 User-Agent: Gnus/5.0808 (Gnus v5.8.8) Emacs/20.7 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-kink@mail.vpnc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Sorry for the (extremely) late wrapup. There were very few comments about the KINK draft during WG last call, and all of them said "let's move forward". The only thing that I noticed personally in a final reading is that the draft does not discuss a reachability test before actually processing the AP_REQ (Create) message. I don't recall if we decided that we don't need one, of this was an oversight. Mike? Other than that issue, I think we're ready to move forward. Mike, what's your plan with regards to reachability? -derek -- Derek Atkins Computer and Internet Security Consultant derek@ihtfp.com www.ihtfp.com From owner-ietf-kink@mail.vpnc.org Fri Feb 15 16:58:03 2002 Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA20992 for ; Fri, 15 Feb 2002 16:58:03 -0500 (EST) Received: by above.proper.com (8.11.6/8.11.3) id g1FLokX15467 for ietf-kink-bks; Fri, 15 Feb 2002 13:50:46 -0800 (PST) Received: from sj-msg-core-4.cisco.com (sj-msg-core-4.cisco.com [171.71.163.10]) by above.proper.com (8.11.6/8.11.3) with ESMTP id g1FLoj315463 for ; Fri, 15 Feb 2002 13:50:45 -0800 (PST) Received: from mira-sjc5-7.cisco.com (mira-sjc5-7.cisco.com [171.71.163.27]) by sj-msg-core-4.cisco.com (8.11.3/8.9.1) with ESMTP id g1FLo5t29852; Fri, 15 Feb 2002 13:50:05 -0800 (PST) Received: from thomasm-u1.cisco.com (thomasm-u1.cisco.com [128.107.140.53]) by mira-sjc5-7.cisco.com (Mirapoint) with ESMTP id AAX13200; Fri, 15 Feb 2002 13:49:35 -0800 (PST) Received: (thomasm@localhost) by thomasm-u1.cisco.com (8.8.8-Cisco List Logging/CISCO.WS.1.2) id NAA28201; Fri, 15 Feb 2002 13:50:04 -0800 (PST) From: Michael Thomas MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <15469.33420.40995.642344@thomasm-u1.cisco.com> Date: Fri, 15 Feb 2002 13:50:04 -0800 (PST) To: Derek Atkins Cc: mat@cisco.com, ietf-kink@vpnc.org Subject: KINK draft wrap-up In-Reply-To: References: X-Mailer: VM 6.72 under 21.1 (patch 6) "Big Bend" XEmacs Lucid X-Face: &,heK/V66p?[2!i|tVn,9lN0TUvEv7:9FzXREj/AuzN4mu!4x[/Z4t{V}~L]+Sk @RFNnJEg~WZ/(8<`5a),-7ukALWa^&?&D2R0CSG3kO5~#6JxLF\d,g">$%B!0w{W)qIhmwhye104zd bUcI'1! Sender: owner-ietf-kink@mail.vpnc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Content-Transfer-Encoding: 7bit Derek Atkins writes: > Sorry for the (extremely) late wrapup. There were very few comments > about the KINK draft during WG last call, and all of them said "let's > move forward". > > The only thing that I noticed personally in a final reading is that > the draft does not discuss a reachability test before actually > processing the AP_REQ (Create) message. I don't recall if we decided > that we don't need one, of this was an oversight. Mike? No, I don't think we need one. The reason is because the ap-req is directly verifiable and thus state is not installed unless it authenticates correctly. This is in contrast to IKE which needs to create state before the cert exchange happens which can lead to a DoS attack via expensive DH exponentiation from an unauthenticated initiator. Mike From owner-ietf-kink@mail.vpnc.org Fri Feb 15 17:13:51 2002 Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA21314 for ; Fri, 15 Feb 2002 17:13:50 -0500 (EST) Received: by above.proper.com (8.11.6/8.11.3) id g1FMBKX16007 for ietf-kink-bks; Fri, 15 Feb 2002 14:11:20 -0800 (PST) Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by above.proper.com (8.11.6/8.11.3) with ESMTP id g1FMBI316002 for ; Fri, 15 Feb 2002 14:11:19 -0800 (PST) Received: from grand-central-station.mit.edu (GRAND-CENTRAL-STATION.MIT.EDU [18.7.21.82]) by pacific-carrier-annex.mit.edu (8.9.2/8.9.2) with ESMTP id RAA16284; Fri, 15 Feb 2002 17:11:21 -0500 (EST) Received: from melbourne-city-street.mit.edu (MELBOURNE-CITY-STREET.MIT.EDU [18.7.21.86]) by grand-central-station.mit.edu (8.9.2/8.9.2) with ESMTP id RAA14645; Fri, 15 Feb 2002 17:11:20 -0500 (EST) Received: from kikki.mit.edu (KIKKI.MIT.EDU [18.18.1.142]) by melbourne-city-street.mit.edu (8.9.2/8.9.2) with ESMTP id RAA01445; Fri, 15 Feb 2002 17:05:25 -0500 (EST) Received: (from warlord@localhost) by kikki.mit.edu (8.9.3) id RAA05170; Fri, 15 Feb 2002 17:05:24 -0500 (EST) To: Michael Thomas Cc: ietf-kink@vpnc.org From: Derek Atkins Subject: Re: KINK draft wrap-up References: <15469.33420.40995.642344@thomasm-u1.cisco.com> Date: 15 Feb 2002 17:05:24 -0500 In-Reply-To: <15469.33420.40995.642344@thomasm-u1.cisco.com> Message-ID: Lines: 34 User-Agent: Gnus/5.0808 (Gnus v5.8.8) Emacs/20.7 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-kink@mail.vpnc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Ok.. I suppose people don't think that a DES/3DES decrypt is high overhead. In that case, I'll contact Marcus and ask to move KINK to IETF last-call. -derek Michael Thomas writes: > Derek Atkins writes: > > Sorry for the (extremely) late wrapup. There were very few comments > > about the KINK draft during WG last call, and all of them said "let's > > move forward". > > > > The only thing that I noticed personally in a final reading is that > > the draft does not discuss a reachability test before actually > > processing the AP_REQ (Create) message. I don't recall if we decided > > that we don't need one, of this was an oversight. Mike? > > No, I don't think we need one. The reason is because > the ap-req is directly verifiable and thus state is > not installed unless it authenticates correctly. This > is in contrast to IKE which needs to create state > before the cert exchange happens which can lead to > a DoS attack via expensive DH exponentiation from > an unauthenticated initiator. > > Mike -- Derek Atkins Computer and Internet Security Consultant derek@ihtfp.com www.ihtfp.com From owner-ietf-kink@mail.vpnc.org Fri Feb 22 16:04:36 2002 Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA25085 for ; Fri, 22 Feb 2002 16:04:36 -0500 (EST) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id g1MKv2A13062 for ietf-kink-bks; Fri, 22 Feb 2002 12:57:02 -0800 (PST) Received: from ietf.org (odin.ietf.org [132.151.1.176]) by above.proper.com (8.11.6/8.11.3) with ESMTP id g1MKv0313058 for ; Fri, 22 Feb 2002 12:57:01 -0800 (PST) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24284; Fri, 22 Feb 2002 15:57:00 -0500 (EST) Message-Id: <200202222057.PAA24284@ietf.org> To: IETF-Announce: ; Cc: ietf-kink@vpnc.org From: The IESG SUBJECT: Last Call: Kerberized Internet Negotiation of Keys (KINK) to Proposed Standard Reply-to: iesg@ietf.org Date: Fri, 22 Feb 2002 15:56:59 -0500 Sender: owner-ietf-kink@mail.vpnc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: The IESG has received a request Kerberized Internet Negotiation of Keys to consider Kerberized Internet Negotiation of Keys (KINK) as a Proposed Standard. The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send any comments to the iesg@ietf.org or ietf@ietf.org mailing lists by March 8, 2002. Files can be obtained via http://www.ietf.org/internet-drafts/draft-ietf-kink-kink-02.txt