From nobody Tue Feb 2 13:35:01 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C040D1B2FB3 for ; Tue, 2 Feb 2016 13:35:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.303 X-Spam-Level: X-Spam-Status: No, score=-2.303 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a0m0jeB73loE for ; Tue, 2 Feb 2016 13:34:59 -0800 (PST) Received: from dmz-mailsec-scanner-8.mit.edu (dmz-mailsec-scanner-8.mit.edu [18.7.68.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E09FB1B2F2B for ; Tue, 2 Feb 2016 13:34:57 -0800 (PST) X-AuditID: 12074425-a9fff70000000a98-5d-56b121009e44 Received: from mailhub-auth-2.mit.edu ( [18.7.62.36]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 83.A9.02712.00121B65; Tue, 2 Feb 2016 16:34:56 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-2.mit.edu (8.13.8/8.9.2) with ESMTP id u12LYtcu020128 for ; Tue, 2 Feb 2016 16:34:56 -0500 Received: from multics.mit.edu (system-low-sipb.mit.edu [18.187.2.37]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id u12LYqi5022997 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 2 Feb 2016 16:34:55 -0500 Received: (from kaduk@localhost) by multics.mit.edu (8.12.9.20060308) id u12LYqiv013158; Tue, 2 Feb 2016 16:34:52 -0500 (EST) Date: Tue, 2 Feb 2016 16:34:52 -0500 (EST) From: Benjamin Kaduk To: kitten@ietf.org Message-ID: User-Agent: Alpine 1.10 (GSO 962 2008-03-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrHIsWRmVeSWpSXmKPExsUixG6nosuguDHM4MNpcYujm1exODB6LFny kymAMYrLJiU1J7MstUjfLoEr43zLRsaCRpaK5S9msDQwTmTuYuTkkBAwkVi8eitTFyMXh5BA G5PE4Z+bGSGcY4wSr5sXskE415kkjmz9xQTSIiRQL9Hf9I0RxGYR0JKYu6WLHcRmE1CRmPlm IxuILSIgLLF76zugFRwcwgJGEgfei4CEeQUcJW5NXcsCYosK6Eis3j+FBSIuKHFy5hMwmxlo 5PLp21gmMPLOQpKahSS1gJFpFaNsSm6Vbm5iZk5xarJucXJiXl5qka6FXm5miV5qSukmRnDQ uKjuYJxwSOkQowAHoxIPL8OPDWFCrIllxZW5hxglOZiURHm75DeGCfEl5adUZiQWZ8QXleak Fh9ilOBgVhLhNZYDyvGmJFZWpRblw6SkOViUxHl79gFNEkhPLEnNTk0tSC2CycpwcChJ8Bor ADUKFqWmp1akZeaUIKSZODhBhvMADRcGqeEtLkjMLc5Mh8ifYtTlWPDj9lomIZa8/LxUKXFe TZAiAZCijNI8uDngaN/NpPqKURzoLWHeOpAqHmCigJv0CmgJE9CS2XzrQZaUJCKkpBoY+7Y7 dx1bt21y8qqNvappLAx7A7eJyLUY/pk2XezNYQFp+XjVBku+9YWH72Za6LmmCb4QCvoRvMJ9 tr7uV/PasHOTP7JduG6bbbwmSFo67f2L+MR3j9nECoMCIl7X8F64deW773W5wmmfmbVqXZN+ e72SrZ3nJjv9ivL5K3HX/0V5fPW6r9yvxFKckWioxVxUnAgAL0M4ftECAAA= Archived-At: Subject: [kitten] topics for kitten session in Buenos Aires X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Feb 2016 21:35:00 -0000 Hi all, The session request deadline for IETF 95 in Buenos Aires is coming up, so we should get a sense for what (if anything) we want to talk about. Given the discussions back in December about AES-GCM and AEAD extensions, new enctypes, and the like, I expect that there should be plenty of things to talk about. Please let the chairs (or the list) know if you have a topic you want to bring up so that we can determine the correct session length to request. Thanks, Ben for the kitten chairs From nobody Thu Feb 18 18:22:39 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CEB261A6FC3; Thu, 18 Feb 2016 18:22:37 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Meeting Session Request Tool\"" To: X-Test-IDTracker: no X-IETF-IDTracker: 6.14.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160219022237.16664.2094.idtracker@ietfa.amsl.com> Date: Thu, 18 Feb 2016 18:22:37 -0800 Archived-At: Cc: kitten@ietf.org, kitten-chairs@ietf.org Subject: [kitten] kitten - New Meeting Session Request for IETF 95 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Feb 2016 02:22:38 -0000 A new meeting session request has just been submitted by Benjamin Kaduk, a Chair of the kitten working group. --------------------------------------------------------- Working Group Name: Common Authentication Technology Next Generation Area Name: Security Area Session Requester: Benjamin Kaduk Number of Sessions: 1 Length of Session(s): 1 Hour Number of Attendees: 20 Conflicts to Avoid: First Priority: abfab ace httpauth httpbis cose curdle jose jsonbis oauth saag radext tls uta Second Priority: precis sidr trans nfsv4 Special Requests: --------------------------------------------------------- From nobody Wed Feb 24 09:29:09 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E56A31B39EC; Wed, 24 Feb 2016 09:29:05 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.14.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160224172905.3967.47362.idtracker@ietfa.amsl.com> Date: Wed, 24 Feb 2016 09:29:05 -0800 Archived-At: Cc: kitten@ietf.org Subject: [kitten] I-D Action: draft-ietf-kitten-pkinit-freshness-03.txt X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Feb 2016 17:29:06 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Common Authentication Technology Next Generation of the IETF. Title : Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) Freshness Extension Authors : Michiko Short Seth Moore Paul Miller Filename : draft-ietf-kitten-pkinit-freshness-03.txt Pages : 8 Date : 2016-02-24 Abstract: This document describes how to further extend the Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) extension [RFC4556] to exchange an opaque data blob that a KDC can validate to ensure that the client is currently in possession of the private key during a PKINIT AS exchange. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-kitten-pkinit-freshness-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-kitten-pkinit-freshness-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Feb 24 10:40:17 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 110921B3C88 for ; Wed, 24 Feb 2016 10:40:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.207 X-Spam-Level: X-Spam-Status: No, score=-4.207 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.006, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LWmJGgtgzHTF for ; Wed, 24 Feb 2016 10:40:14 -0800 (PST) Received: from dmz-mailsec-scanner-3.mit.edu (dmz-mailsec-scanner-3.mit.edu [18.9.25.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D52961B3C86 for ; Wed, 24 Feb 2016 10:40:13 -0800 (PST) X-AuditID: 1209190e-c13ff70000002722-38-56cdf90c8d70 Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 00.51.10018.C09FDC65; Wed, 24 Feb 2016 13:40:12 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id u1OIeClR000961 for ; Wed, 24 Feb 2016 13:40:12 -0500 Received: from [18.101.8.220] (vpn-18-101-8-220.mit.edu [18.101.8.220]) (authenticated bits=0) (User authenticated as ghudson@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id u1OIeA89030853 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT) for ; Wed, 24 Feb 2016 13:40:11 -0500 To: kitten@ietf.org References: <20160224172905.3967.47362.idtracker@ietfa.amsl.com> From: Greg Hudson X-Enigmail-Draft-Status: N1110 Message-ID: <56CDF90A.6010403@mit.edu> Date: Wed, 24 Feb 2016 13:40:10 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1 MIME-Version: 1.0 In-Reply-To: <20160224172905.3967.47362.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrEIsWRmVeSWpSXmKPExsUixCmqrcvz82yYweMePYujm1exODB6LFny kymAMYrLJiU1J7MstUjfLoErY0b/X5aCy9wVkw5PY2tgPMTZxcjJISFgInGu4xBTFyMXh5BA G5PEu71P2CCc44wSEye0QDm3mCSWbJjIDtIiLOAt8eFBCzOILSIgLLF76zswW0jAQWLfuXtM IDabgLLE+v1bWSBWyEn0dk8Csjk4eAXUJFb+EgEJswioSsx5sRGsRFQgQuJwZxfYeF4BQYmT M5+AxTkFHCWen94MNp5ZQE9ix/VfrBC2vETz1tnMExgFZiFpmYWkbBaSsgWMzKsYZVNyq3Rz EzNzilOTdYuTE/PyUot0jfVyM0v0UlNKNzGCg1KSbwfj14NKhxgFOBiVeHgfbDgTJsSaWFZc mXuIUZKDSUmUV+Xr2TAhvqT8lMqMxOKM+KLSnNTiQ4wSHMxKIrxyT4FyvCmJlVWpRfkwKWkO FiVx3pibR8OEBNITS1KzU1MLUotgsjIcHEoSvGe+AzUKFqWmp1akZeaUIKSZODhBhvMADV8I UsNbXJCYW5yZDpE/xagoJc7rDpIQAElklObB9YKTRirHnVeM4kCvCPMy/QCq4gEmHLjuV0CD mYAG3952CmRwSSJCSqqBUaxqUly8df7Nv1POnJSNjZPP2LVYMnOKeueX3UIVKfvsOhNuJcef MHSX/b99ctZLhfW2t3/+atu2WP9SyI+5QRXhvZ+3qjeoX1ilpM34aHLD0iLrVqnj13LZyyWe Cp2xlD8tbXmQ88kS/+5WL5e5Jj+Vzv+0/OB67mLZ3x0LVFyjdr10dn/tosRSnJFoqMVcVJwI AN/QcR31AgAA Archived-At: Subject: Re: [kitten] I-D Action: draft-ietf-kitten-pkinit-freshness-03.txt X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Feb 2016 18:40:16 -0000 This version of the draft contains the following new text in section 2.4: > If the realm requires freshness and the PA_PK_AS_REQ message does not > contain the freshness token, the KDC MUST return a KRB_ERROR > [RFC4120] message with the error-code KDC_ERR_PREAUTH_REQUIRED > [RFC4120] with a padata element with padata-type PA_AS_FRESHNESS and > padata-value of the freshness token to the METHOD-DATA object. My initial reaction to this text was that it sounds like protocol wishful thinking. If the client is too old to support freshness tokens, re-sending the same KRB_ERROR as the KDC sent in step 2.2 will not cause the client to magically develop that support. It is possible that this text is intended to apply when a client does support freshness tokens, but did not use one because it was attempting optimistic PKINIT (so sections 2.1-2.3 did not occur). I'm not sure it makes sense for a client with freshness token support to perform optimistic PKINIT; such optimist attempts will only become less optimal over time as KDCs start to require freshness tokens. If this text is intended to apply to an optimist PKINIT scenario, then it is inconsistent with RFC 6113, which specifies the use of KDC_ERR_PREAUTH_FAILED to indicate failures of optimistic pre-authentication. On a less important note, the new text in section 2.2 is not grammatically correct; it uses the construction "The KDC will respond with a [message] and adding a padata [...]".