From nobody Fri Oct 7 20:55:42 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6C46129457 for ; Fri, 7 Oct 2016 20:55:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=secure-endpoints.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rYfPhO8Sf3OW for ; Fri, 7 Oct 2016 20:55:39 -0700 (PDT) Received: from sequoia-grove.secure-endpoints.com (sequoia-grove.ad.secure-endpoints.com [208.125.0.235]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DDE87129435 for ; Fri, 7 Oct 2016 20:55:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=secure-endpoints.com; s=MDaemon; t=1475898915; x=1476503715; i=jaltman@secure-endpoints.com; q=dns/txt; h=VBR-Info:Subject:To: References:Cc:From:Openpgp:Organization:Message-ID:Date: User-Agent:MIME-Version:In-Reply-To:Content-Type; bh=ToAenBWB/GV 2/USVbQi1zfAH1GrbdmFcP3miURi/JQM=; b=bm566O2/jJ8k7UDyhfDWnzm5llx kA9OwDFGkp1qHDQk2CH5/cj0TCODK7d30V5MbThgr8RZnEqMknm8n2WfXy3ZbCXX 0SBD3oV7zNIK0y+KGRNo40zIdMaNcD6h6WjM8oSRf//vk3EXtUpxBx3UWJ8YBEMk 16swA399QhdazUcg= X-MDAV-Result: clean X-MDAV-Processed: sequoia-grove.secure-endpoints.com, Fri, 07 Oct 2016 23:55:15 -0400 X-Spam-Processed: sequoia-grove.secure-endpoints.com, Fri, 07 Oct 2016 23:55:15 -0400 Received: from [IPv6:2001:470:1f07:f77:751a:93c7:e539:aa54] by secure-endpoints.com (Cipher TLSv1:AES-SHA:256) (MDaemon PRO v16.5.0) with ESMTPSA id md50001168750.msg for ; Fri, 07 Oct 2016 23:55:14 -0400 VBR-Info: md=secure-endpoints.com; mc=all; mv=vbr.emailcertification.org; X-MDRemoteIP: 2001:470:1f07:f77:751a:93c7:e539:aa54 X-MDHelo: [IPv6:2001:470:1f07:f77:751a:93c7:e539:aa54] X-MDArrival-Date: Fri, 07 Oct 2016 23:55:14 -0400 X-Authenticated-Sender: jaltman@secure-endpoints.com X-Return-Path: prvs=10896f4fa1=jaltman@secure-endpoints.com X-Envelope-From: jaltman@secure-endpoints.com X-MDaemon-Deliver-To: kitten@ietf.org To: Stephen Farrell , Greg Hudson , Benjamin Kaduk References: <147276103576.32168.16561985797578576426.idtracker@ietfa.amsl.com> <9b612ac1-0288-dc0f-92b6-9045691ea872@secure-endpoints.com> <8d70c265-cb18-fb41-bfc5-b3169eb2da06@cs.tcd.ie> <2d8b46c6-cb98-fe6b-c465-8bbd92c82ba0@mit.edu> From: Jeffrey Altman Openpgp: id=FA444AF197F449B24CF3E699F77A735592B69A04; url=http://pgp.mit.edu Organization: Secure Endpoints Inc. Message-ID: Date: Fri, 7 Oct 2016 23:55:07 -0400 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms030208030504050305060207" Archived-At: Cc: kitten@ietf.org Subject: Re: [kitten] Document Action: 'AES Encryption with HMAC-SHA2 for Kerberos 5' to Informational RFC (draft-ietf-kitten-aes-cts-hmac-sha2-11.txt) X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Oct 2016 03:55:41 -0000 This is a cryptographically signed message in MIME format. --------------ms030208030504050305060207 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable IANA has updated the protocol registries with the assignments for encryption and checksum types for this RFC. --------------ms030208030504050305060207 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC DFkwggYVMIIE/aADAgECAhBwEYNf9/MBLeKNZZ697cPvMA0GCSqGSIb3DQEBCwUAMIGmMQsw CQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5 bWFudGVjIFRydXN0IE5ldHdvcmsxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3 MDUGA1UEAxMuU3ltYW50ZWMgQ2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBH NTAeFw0xNTEyMjAwMDAwMDBaFw0xNjEyMjAyMzU5NTlaMIGvMS4wLAYDVQQDDCVQZXJzb25h IE5vdCBWYWxpZGF0ZWQgLSAxNDUwNTc0MTU1Njc5MSswKQYJKoZIhvcNAQkBFhxqYWx0bWFu QHNlY3VyZS1lbmRwb2ludHMuY29tMQ8wDQYDVQQLDAZTL01JTUUxHjAcBgNVBAsMFVBlcnNv bmEgTm90IFZhbGlkYXRlZDEfMB0GA1UECwwWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazCCASIw DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM0X8uixbo9Tu+sKS20bZeCbN9brFQbtkQ5x /6MrkGsQNTzQ/2WZFJzH89ZoC8auZRFQdA6/yh4wXdCNQ6hBO8Lom26t0LHGhoWtzdkP7MWu YeLMZiuOsC6N6ejHEbtt0KLjphNIUvBVFx5JQzgAwJ1I08LSZg/bIGAVF3SfLOVFu2Iiq5kj psHOv/ECV13fGSvYwBXJN1C1To6wxDgn4pl3m6fFfe4xiVEpc3t6GbKcI+4blK9w76fDaVXw U2uJQAG1UYxbChwocBmb3ka1MlUb2ug3oYBpnufD9zk8u3UqaFlfYyr6/2cr6fqiz1U4+xcb Q3otvVWwzRecpmPEiIcCAwEAAaOCAjIwggIuMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQD AgWgMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4EFgQU2Pc1OxE6 W8hcBZ5L2346cucbFa8wJwYDVR0RBCAwHoEcamFsdG1hbkBzZWN1cmUtZW5kcG9pbnRzLmNv bTBsBgNVHSAEZTBjMGEGC2CGSAGG+EUBBxcBMFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cu c3ltYXV0aC5jb20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20v cnBhMF0GA1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9wa2ktY3JsLnN5bWF1dGguY29tL2NhXzU3 ZGU3YTIzOGQ0NWQ4ZDRmYzcxZjhhNWM2YjgxYzkzL0xhdGVzdENSTC5jcmwwTgYIKwYBBQUH AQEEQjBAMD4GCCsGAQUFBzAChjJodHRwOi8vY2FjZXIuc3ltYXV0aC5jb20vbXBraS9zeW1j YzFpbmRzdWJjYWc1LmNydDAfBgNVHSMEGDAWgBRnGbY9pXm7M2DYLVPTjAk9B6wYcDArBgpg hkgBhvhFARADBB0wGwYSYIZIAYb4RQEQAQICBAGt7pITFgUxMDkyMjA5BgpghkgBhvhFARAF BCswKQIBABYkYUhSMGNITTZMeTl3YTJrdGNtRXVjM2x0WVhWMGFDNWpiMjA9MA0GCSqGSIb3 DQEBCwUAA4IBAQBvO/+L6Tms91Ed1ZJzgT0y9jBK/Armb6Y/EnR1swCDMqRfBzGSGtzOCuN7 PteBvlaB5vmnwEwiZR/FtsDhhORd8Xy5wdmCunhwPbf0ClnBqichI+4UZNS5fCQTciIqHFxq 7EKuHOQm4/ssEH2Xr8yIpCd+Dx9oPEG7MqUno6oxcIDdur4iNKxOBtjWNiXM7rn733qtuFlw 1jIX3eFIsrBALikTU1UbY2KwfewXbiVaFWY0ysl5uOgfWdmj2xBk7aft/L/fnuyWyeeM9IBg 6vdUjPhmJwtFdEdefgP5cRRdYgG8zgJf8Rq84slkea0bwis8PvKVksJ/k2scaDHzKTe2MIIG PDCCBSSgAwIBAgIQBwKiGoW4S2WeGApu5vWjZTANBgkqhkiG9w0BAQsFADCByjELMAkGA1UE BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVz dCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRo b3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmlt YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzMwHhcNMTUxMDAxMDAwMDAwWhcNMjUw OTMwMjM1OTU5WjCBpjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0 aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMR4wHAYDVQQLExVQZXJzb25h IE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMTLlN5bWFudGVjIENsYXNzIDEgSW5kaXZpZHVhbCBT dWJzY3JpYmVyIENBIC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDW+w0x SSLADLrvTi0XuLQw5TTSrAnuyYkAXfSuExGzE45VzyIYqCAGpv0ly2iUtKCCkA5ulpJE7hW5 tOz6z3k9adScH9wgmg4o1Q21xp468dRlGcCEM02O2orx1ie5A6DR+iicgpNs9w2FfVvpTpli /pNC0u4+s3FXhpdGy98N4caEWrMNj/X0EIoFXZ9oRuwIsFhCgva+LRBGpiQLJ/6YFFODk4Lb 6sA/T6JYYbVLcmkSXzNZ9vmzTABkzoXFhpIMbhzrKM9xqZCpdJl0JOtI4Q5daBKoAWbo7pqy L/g9zbd4JM6lYHzoFj1J8Qe6M74yK8JnoxbHb8DSWpQEwmtFAgMBAAGjggI+MIICOjA3Bggr BgEFBQcBAQQrMCkwJwYIKwYBBQUHMAGGG2h0dHA6Ly9wa2ktb2NzcC5zeW1hdXRoLmNvbTAS BgNVHRMBAf8ECDAGAQH/AgEAMGwGA1UdIARlMGMwYQYLYIZIAYb4RQEHFwEwUjAmBggrBgEF BQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDov L3d3dy5zeW1hdXRoLmNvbS9ycGEwLwYDVR0fBCgwJjAkoCKgIIYeaHR0cDovL3Muc3ltY2Iu Y29tL3BjYTEtZzMuY3JsMA4GA1UdDwEB/wQEAwIBBjApBgNVHREEIjAgpB4wHDEaMBgGA1UE AxMRU3ltYW50ZWNQS0ktMi0yMTcwHQYDVR0OBBYEFGcZtj2lebszYNgtU9OMCT0HrBhwMIHx BgNVHSMEgekwgeahgdCkgc0wgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwg SW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5 OTkgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8 VmVyaVNpZ24gQ2xhc3MgMSBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 eSAtIEczghEAi1t1VoRUhQsAz684SM6xpDANBgkqhkiG9w0BAQsFAAOCAQEARhnkJ3U7vq/i 2qIUYI8eRJCBaStjSTWN6Xa6n5iPE4HXy/xlG/gOY96UKHT742/YySp6DlSmg64pSvYrUf09 OBK73WNF+2TMPlSGf05CbSO3HQv9+swNjpM1yuVF+c8vf3k9YxjHRyNK9qkUAK1+WVUaiSfb lKCROMb+QJWjYPZduMjFFu2cZmkURhBKynAqb9FQ4CYa01K0R3KLRdK9A7ml3NkI85CrdHCr yqBO8MBO5OC+T5ARYCcMKxzf52zKdbQl55FIqpK0UXVfKZtHFxy9yerPda11I8/yxd9aq7dr yru4XqvVo3DUaPMXepsLoBQ8++iBVmjoz118c7guvDGCBGIwggReAgEBMIG7MIGmMQswCQYD VQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFu dGVjIFRydXN0IE5ldHdvcmsxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUG A1UEAxMuU3ltYW50ZWMgQ2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHNQIQ cBGDX/fzAS3ijWWeve3D7zANBglghkgBZQMEAgEFAKCCAncwGAYJKoZIhvcNAQkDMQsGCSqG SIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYxMDA4MDM1NTA3WjAvBgkqhkiG9w0BCQQxIgQg nQc1uNbUJY+75ACTfz7y73cDiEMm69Ho7YuhwR8NOiYwbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBzAYJKwYBBAGCNxAEMYG+MIG7 MIGmMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNV BAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlk YXRlZDE3MDUGA1UEAxMuU3ltYW50ZWMgQ2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIg Q0EgLSBHNQIQcBGDX/fzAS3ijWWeve3D7zCBzgYLKoZIhvcNAQkQAgsxgb6ggbswgaYxCzAJ BgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3lt YW50ZWMgVHJ1c3QgTmV0d29yazEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcw NQYDVQQDEy5TeW1hbnRlYyBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEc1 AhBwEYNf9/MBLeKNZZ697cPvMA0GCSqGSIb3DQEBAQUABIIBAHeFOiYAQZb+JNm6/Iq/uTm4 RsGVG8gYtzhGFZeyfUadpK1ug0XeG0DjNUIaD59XxtjLvQlP2fK/Dty80X5Ro5mgFOPCXkbI HMGL6YPO6EiaYd9FcBHyx5kq1GHcKKtDJYUm1Eyb3Qtq2FgTpuZnayeFUQPddufvoK1h93cE FriG2CNsovKf+B6f2uGc5NIB7TM7X6JkJCEloY4U3ydIq6wTZVRPHfRWcB1s3hlYuoWS1cSd JgPpLPSeWY6ka9uJ1LnHPw1wNRi9YZAeHuEYu8zSfZ0eHCAF3Bj0MAuKUEwwzt5viQOzWRq3 XwJHx4uxt1rIZuFMWIxJZFo8LZW2b84AAAAAAAA= --------------ms030208030504050305060207-- From nobody Wed Oct 12 13:46:59 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 09B07129675 for ; Wed, 12 Oct 2016 13:46:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.918 X-Spam-Level: X-Spam-Status: No, score=-9.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.996, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T203t21lYZXm for ; Wed, 12 Oct 2016 13:46:56 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 462FF129673 for ; Wed, 12 Oct 2016 13:46:56 -0700 (PDT) Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id A708EC04B928 for ; Wed, 12 Oct 2016 20:46:55 +0000 (UTC) Received: from vpn-58-163.rdu2.redhat.com (vpn-58-163.rdu2.redhat.com [10.10.58.163]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u9CKksqO000651 for ; Wed, 12 Oct 2016 16:46:55 -0400 Message-ID: <1476305214.14318.20.camel@redhat.com> From: Matt Rogers To: kitten@ietf.org Date: Wed, 12 Oct 2016 16:46:54 -0400 Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Wed, 12 Oct 2016 20:46:55 +0000 (UTC) Archived-At: Subject: [kitten] Service discovery URI field case-sensitivity X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Oct 2016 20:46:58 -0000 The service discovery draft needs some clarification of the encoding and case sensitivity for the URI field values, and I have heard some different views on how they should be defined.  First I believe the scheme should be case-insensitive per BCP 35 advice on URI scheme values.  Flags, if specified as case-sensitive would allow more flag values at the expense of some possible operator confusion (however, the values will be IANA registered and a valid character range specified). Transport type values will also be IANA registered and case-sensitivity would not gain us anything here. These fields are currently case- insensitive in the MIT krb5 implementation. Transport info field can have both case-sensitive and case-insensitive elements as defined by the transport, like the KKDCP path and hostname. MIT krb5 treats KKDCP URLs in this respect. Overall my preference would be to define in their respective sections, the scheme, flags, and transport-type fields as case-insensitive and say the transport-info field's case rules are to determined by the transport specification.  Although this limits the flags, If we really ran out of flags in the future then the document could be updated. Regards, Matt From nobody Thu Oct 13 08:29:11 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C9401293DC for ; Thu, 13 Oct 2016 08:29:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.196 X-Spam-Level: X-Spam-Status: No, score=-7.196 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-2.996, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yS2vUQ_0Arfo for ; Thu, 13 Oct 2016 08:29:07 -0700 (PDT) Received: from dmz-mailsec-scanner-4.mit.edu (dmz-mailsec-scanner-4.mit.edu [18.9.25.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C1A01298D0 for ; Thu, 13 Oct 2016 08:29:04 -0700 (PDT) X-AuditID: 1209190f-89bff70000001758-82-57ffa83eb52d Received: from mailhub-auth-4.mit.edu ( [18.7.62.39]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 85.77.05976.E38AFF75; Thu, 13 Oct 2016 11:29:03 -0400 (EDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-4.mit.edu (8.13.8/8.9.2) with ESMTP id u9DFT2ep010045; Thu, 13 Oct 2016 11:29:02 -0400 Received: from [18.101.8.159] (vpn-18-101-8-159.mit.edu [18.101.8.159]) (authenticated bits=0) (User authenticated as ghudson@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id u9DFSwlj003408 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Thu, 13 Oct 2016 11:29:01 -0400 To: Matt Rogers , kitten@ietf.org References: <1476305214.14318.20.camel@redhat.com> From: Greg Hudson Message-ID: <5f14f0d2-815f-5f46-0bbe-037aa906d2ae@mit.edu> Date: Thu, 13 Oct 2016 11:28:58 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: <1476305214.14318.20.camel@redhat.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrHIsWRmVeSWpSXmKPExsUixG6nrmu/4n+4wca5ehZHN69isbg/Mc6B yWPJkp9MHu/3XWULYIrisklJzcksSy3St0vgyli86DxbwT3Oij89r5gaGL+ydzFyckgImEh0 vd3JAmILCbQxSTy97N3FyAVkb2SUWP/sKSuEc5RJ4uD6RUwgVcICThJHFjWDdYgImEosP/GA GaLbSOLJ1HdgU9kElCXW798KVsMrYCWxsf0MK4jNIqAq0XjvP1i9qECExK2HHVA1ghInZz4B sjk4OAWMJV68ARvDLKAu8WfeJWYIW15i+9s5zBMY+Wch6ZiFpGwWkrIFjMyrGGVTcqt0cxMz c4pTk3WLkxPz8lKLdE30cjNL9FJTSjcxgoKRU5J/B+OcBu9DjAIcjEo8vB5B/8KFWBPLiitz DzFKcjApifL+8vsfLsSXlJ9SmZFYnBFfVJqTWnyIUYKDWUmEl2UxUI43JbGyKrUoHyYlzcGi JM773+1ruJBAemJJanZqakFqEUxWhoNDSYKXfTlQo2BRanpqRVpmTglCmomDE2Q4D9Dw38tA hhcXJOYWZ6ZD5E8xKkqJ8+5dCpQQAElklObB9YKTRSrH/FeM4kCvCPMyg6zgASYauO5XQIOZ gAbbTPoDMrgkESEl1cAYdfpOUY2a6ZRMK/MEt80+lx+d/57VJZT5XfXurXXP/378Vp/RPmlH tuPqlZM/nFTRCswOWub1d27t9uqibZybJdRaTuhXblEPXKTVe2Vy6UZX68ijQl+P/Hx9RbrN a0LAXY7Lal7LP4reClm/tCVVwE5iphrPDMYLvjVZL4uLNibbGTKny05TYinOSDTUYi4qTgQA q+eSPfECAAA= Archived-At: Subject: Re: [kitten] Service discovery URI field case-sensitivity X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Oct 2016 15:29:09 -0000 On 10/12/2016 04:46 PM, Matt Rogers wrote: > The service discovery draft needs some clarification of the encoding > and case sensitivity for the URI field values, and I have heard some > different views on how they should be defined. This is in reference to draft-mccallum-kitten-krb-service-discovery-03. > First I believe the scheme should be case-insensitive per BCP 35 advice > on URI scheme values. Our scheme, "krb5srv"? Formally, I'm not sure if we have to specify that when defining a new scheme, but informally we should recommend that URI record processing code match the scheme case-insensitively. The scheme in the transport-info for kkdcp should also be matched case-insensitively, of course. > Overall my preference would be to define in their respective sections, > the scheme, flags, and transport-type fields as case-insensitive and > say the transport-info field's case rules are to determined by the > transport specification. Although this limits the flags, If we really > ran out of flags in the future then the document could be updated. Agreed. It's unlikely that we will ever add a second flag; it's vanishingly unlikely that we will need more than 26 (or 36 with digits, or whatever). From nobody Mon Oct 17 08:48:47 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11FED1295B1 for ; Mon, 17 Oct 2016 08:48:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.333 X-Spam-Level: X-Spam-Status: No, score=-7.333 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.431, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IZLsOjg4WkzQ for ; Mon, 17 Oct 2016 08:48:44 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8ED00129595 for ; Mon, 17 Oct 2016 08:48:44 -0700 (PDT) Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 1276C61A0F for ; Mon, 17 Oct 2016 15:48:44 +0000 (UTC) Received: from vpn-54-190.rdu2.redhat.com (vpn-54-190.rdu2.redhat.com [10.10.54.190]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u9HFmhJH006015 for ; Mon, 17 Oct 2016 11:48:43 -0400 Message-ID: <1476719323.13238.1.camel@redhat.com> From: Matt Rogers To: kitten@ietf.org Date: Mon, 17 Oct 2016 11:48:43 -0400 Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Mon, 17 Oct 2016 15:48:44 +0000 (UTC) Archived-At: Subject: [kitten] Shepherd review: draft-ietf-kitten-pkinit-freshness-07 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Oct 2016 15:48:46 -0000 Hi, During my review of draft-ietf-kitten-pkinit-freshness-07, the idnits checker brought up the following issues:  Checking nits according to http://www.ietf.org/id-info/checklist :   ------------------------------------------------------------------- ---------   ** The abstract seems to contain references ([RFC4556]), which it      shouldn't.  Please replace those with straight textual mentions of the      documents in question.   Miscellaneous warnings:   ------------------------------------------------------------------- ---------   -- The document date (May 23, 2016) is 147 days in the past.  Is this      intentional?   Checking references for intended status: Proposed Standard   ------------------------------------------------------------------- ---------      (See RFCs 3967 and 4897 for information about using normative references      to lower-maturity documents in RFCs)   -- Looks like a reference, but probably isn't: '0' on line 224      'cusec        [0] INTEGER (0..999999),...'   -- Looks like a reference, but probably isn't: '1' on line 225      'ctime        [1] KerberosTime,...'   -- Looks like a reference, but probably isn't: '2' on line 228      'nonce        [2] INTEGER (0..4294967295),...'   -- Looks like a reference, but probably isn't: '3' on line 231      'paChecksum   [3] OCTET STRING OPTIONAL,...'   -- Looks like a reference, but probably isn't: '4' on line      236 'freshnessToken     [4] OCTET STRING OPTIONAL,...'   == Missing Reference: 'This RFC' is mentioned on line 261, but not      defined '| 150  | PA_AS_FRESHNESS | [This RFC] |...'   ** Downref: Normative reference to an Informational RFC: RFC 5349      Summary: 2 errors (**), 0 flaws (~~), 1 warning (==), 6 comments (--). An updated document with these corrections, or some comments on these for justification of leaving them be would be helpful. Regards, Matt From nobody Mon Oct 17 21:10:31 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A64E1294F6 for ; Mon, 17 Oct 2016 21:10:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.632 X-Spam-Level: X-Spam-Status: No, score=-4.632 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.431, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e5J61FvZkdZR for ; Mon, 17 Oct 2016 21:10:28 -0700 (PDT) Received: from dmz-mailsec-scanner-6.mit.edu (dmz-mailsec-scanner-6.mit.edu [18.7.68.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 846FD1294FE for ; Mon, 17 Oct 2016 21:10:28 -0700 (PDT) X-AuditID: 12074423-5cbff7000000781a-96-5805a0b18a57 Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 4E.30.30746.1B0A5085; Tue, 18 Oct 2016 00:10:27 -0400 (EDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-1.mit.edu (8.13.8/8.9.2) with ESMTP id u9I4APNY021098; Tue, 18 Oct 2016 00:10:25 -0400 Received: from multics.mit.edu (system-low-sipb.mit.edu [18.187.2.37]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id u9I4AMv4000903 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 18 Oct 2016 00:10:24 -0400 Received: (from kaduk@localhost) by multics.mit.edu (8.12.9.20060308) id u9I4AL9S004166; Tue, 18 Oct 2016 00:10:21 -0400 (EDT) Date: Tue, 18 Oct 2016 00:10:21 -0400 (EDT) From: Benjamin Kaduk To: Matt Rogers In-Reply-To: <1476719323.13238.1.camel@redhat.com> Message-ID: References: <1476719323.13238.1.camel@redhat.com> User-Agent: Alpine 1.10 (GSO 962 2008-03-14) MIME-Version: 1.0 Content-Type: MULTIPART/MIXED; BOUNDARY="-559023410-1545790862-1476763821=:5272" X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrOIsWRmVeSWpSXmKPExsUixCmqrLt5AWuEwextohZHN69isbg/Mc6B yWPJkp9MHu/3XWULYIrisklJzcksSy3St0vgyri9+yNLQaNYxfsLs9gaGLcLdTFyckgImEgs vziVsYuRi0NIoI1J4v3rAywgCSGBjYwSr59HQiQOMUksPHWDGcJpYJRY0rWJDaSKRUBbYuPb 7WAdbAIqEjPfbASKc3CIANlzd4iChJkFhCXWn5vBDGILC/hLnNzcxwRicwoYSXSu/M4IYvMK OEi0rp3OCrHYUOL/hktgtqiAjsTq/VNYIGoEJU7OfMICMTNA4u/dM+wTGAVmIUnNQpKCsNUl Gh+cZYOwtSXu32xjW8DIsopRNiW3Sjc3MTOnODVZtzg5MS8vtUjXTC83s0QvNaV0EyMofNld lHcwvuzzPsQowMGoxMO74QpLhBBrYllxZe4hRkkOJiVR3nlFrBFCfEn5KZUZicUZ8UWlOanF hxglOJiVRHjF5wDleFMSK6tSi/JhUtIcLErivP/dvoYLCaQnlqRmp6YWpBbBZGU4OJQkeN3n AzUKFqWmp1akZeaUIKSZODhBhvMADdcAqeEtLkjMLc5Mh8ifYlSUEudNngeUEABJZJTmwfWC 08tuJtVXjOJArwjzFoG08wBTE1z3K6DBTECDz+WxgAwuSURISTUwqkXJcbRlR+UKzNm69sHE vJpDPpJfV6asvPzBnfWX0q62xRkhvXGbvoYkn1yi8WjO5ZOiZyfv+HHgStXGx5bLpric0i4M Wn9+hkaZf+gjbkF+nWnL1+6x2KoU7DCTt36jkcaL1qarj3cL3wiZwMu3a8V1heUNc14JMaad lJB92sHrJhxzmc91lRJLcUaioRZzUXEiAG3RqmwKAwAA Archived-At: Cc: kitten@ietf.org Subject: Re: [kitten] Shepherd review: draft-ietf-kitten-pkinit-freshness-07 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Oct 2016 04:10:30 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. ---559023410-1545790862-1476763821=:5272 Content-Type: TEXT/PLAIN; charset=utf-8 Content-Transfer-Encoding: QUOTED-PRINTABLE On Mon, 17 Oct 2016, Matt Rogers wrote: > Hi, > > During my review of draft-ietf-kitten-pkinit-freshness-07, the idnits > checker brought up the following issues: > > =C2=A0Checking nits according to http://www.ietf.org/id-info/checklist : > =C2=A0 ------------------------------------------------------------------= - > --------- > > =C2=A0 ** The abstract seems to contain references ([RFC4556]), which it > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0shouldn't.=C2=A0=C2=A0Please replace those = with straight textual mentions of > the > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0documents in question. > > > =C2=A0 Miscellaneous warnings: > =C2=A0 ------------------------------------------------------------------= - > --------- > > =C2=A0 -- The document date (May 23, 2016) is 147 days in the past.=C2=A0= =C2=A0Is this > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0intentional? These two seem to be valid warnings, though the "147 days in the past" is mostly just the chairs' fault. > =C2=A0 Checking references for intended status: Proposed Standard > =C2=A0 ------------------------------------------------------------------= - > --------- > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0(See RFCs 3967 and 4897 for information abo= ut using normative > references > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0to lower-maturity documents in RFCs) > > =C2=A0 -- Looks like a reference, but probably isn't: '0' on line 224 > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0'cusec=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0[0] INTEGER (0..999999),...' The idnits checker doesn't like our ASN.1 explicit tag values; there's nothing we can do other than ignore the nits alerts. > =C2=A0 =3D=3D Missing Reference: 'This RFC' is mentioned on line 261, but= not > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0defined > '| 150=C2=A0=C2=A0| PA_AS_FRESHNESS | [This RFC] |...' This one can probably be ignored as well. There might be some magic text that will have the idnits checker ignore the self-reference, but I don't know what it is. > =C2=A0 ** Downref: Normative reference to an Informational RFC: RFC 5349 > > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0Summary: 2 errors (**), 0 flaws (~~), 1 war= ning (=3D=3D), 6 comments > (--). > > An updated document with these corrections, or some comments on these > for justification of leaving them be would be helpful. An updated document would be nice, but the needed changes are small enough that in my opinion they could be left as RFC Editor notes. -Ben ---559023410-1545790862-1476763821=:5272-- From nobody Tue Oct 18 17:08:20 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 09B651294A1 for ; Tue, 18 Oct 2016 17:08:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.003 X-Spam-Level: X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RddQ4lPbGLlY for ; Tue, 18 Oct 2016 17:08:16 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0136.outbound.protection.outlook.com [104.47.34.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E051129446 for ; Tue, 18 Oct 2016 17:08:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ntv2OwAwYk7pd13C62sZ9cKmPWa6kecYnmK5U/d2SYA=; b=ITiYNebP9zdIKIIbMv2lwDqoT/s6z5o3qhXF6Mjsnfcy+3wE1lQwePy4r7t+z7ZYFl1IJLnGfXLk9gE3OcfAfhLCRNuTWoNDTkKLSXa6Kqv+UV/ZrVY30SiuAYGhyQN1HYSPMnL093a71D7nBR1rZuF512kmqfZwZNU0RCIMnZc= Received: from CY1PR03MB2315.namprd03.prod.outlook.com (10.166.207.138) by CY1PR03MB2316.namprd03.prod.outlook.com (10.166.207.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.12; Wed, 19 Oct 2016 00:08:14 +0000 Received: from CY1PR03MB2315.namprd03.prod.outlook.com ([10.166.207.138]) by CY1PR03MB2315.namprd03.prod.outlook.com ([10.166.207.138]) with mapi id 15.01.0669.018; Wed, 19 Oct 2016 00:08:13 +0000 From: Michiko Short To: Benjamin Kaduk , Matt Rogers Thread-Topic: [kitten] Shepherd review: draft-ietf-kitten-pkinit-freshness-07 Thread-Index: AQHSKXHa1YzUVItdfkKIWhfYHm+6saCu5qGg Date: Wed, 19 Oct 2016 00:08:13 +0000 Message-ID: References: <1476719323.13238.1.camel@redhat.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=michikos@microsoft.com; x-originating-ip: [2001:4898:80e8:7::4f0] x-ms-office365-filtering-correlation-id: b4e88009-8206-48e8-695b-08d3f7b404b1 x-microsoft-exchange-diagnostics: 1; CY1PR03MB2316; 7:5X8AU8pTKGrN5RrX1V+0irXQY0BjC3Z07g5yC/8TmBJwx8yAheerWWffc1PUw6Smk9xcObgRhmi6GQY/PXZl0TmBcPfX5UvkzrdlDIEOsqKIEJjbNt5TtwIu+zMT+q/7Ls80JUrV9VgE/OgVXBVl4srODcHlGhF3RaAPDqEsKtk8YbQIqALEj49anBGoFv4zbhycsdIZkxmYDGdtpUbDLvoU4URSKVlqkk52uSRAfFfzJngcHDJVEDXrjy5X+mR7zDaFyeFgPGED64K2y9vQBjz2e+tn4KBrvsbAvNWre8YuVSejTjFmNprJ79KbeazINBfBAygxSavMGoWwzJkrDAdBCLMWLNkxSddwEMXawtTz9ntjCJ022facjZcY1hvW x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:CY1PR03MB2316; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(788757137089); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040176)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038); SRVR:CY1PR03MB2316; BCL:0; PCL:0; RULEID:; SRVR:CY1PR03MB2316; x-forefront-prvs: 0100732B76 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(24454002)(13464003)(377454003)(199003)(189002)(81156014)(2950100002)(77096005)(5005710100001)(1720100001)(15975445007)(2906002)(76576001)(2900100001)(81166006)(5002640100001)(7736002)(7846002)(4326007)(74316002)(3660700001)(68736007)(92566002)(305945005)(586003)(33656002)(99286002)(6116002)(3280700002)(122556002)(106356001)(106116001)(54356999)(50986999)(86612001)(10090500001)(76176999)(101416001)(10400500002)(87936001)(8936002)(2171001)(10290500002)(105586002)(102836003)(189998001)(5001770100001)(5660300001)(19580405001)(97736004)(9686002)(8676002)(8990500004)(19580395003)(86362001)(7696004)(230783001)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR03MB2316; H:CY1PR03MB2315.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Oct 2016 00:08:13.2119 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR03MB2316 Archived-At: Cc: "kitten@ietf.org" Subject: Re: [kitten] Shepherd review: draft-ietf-kitten-pkinit-freshness-07 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Oct 2016 00:08:19 -0000 QmVuIG9yIE1hdHQsIGRvIHlvdSBuZWVkIG1lIHRvIHVwZGF0ZSBvciBhcmUgd2UgZ29vZCB3aXRo IHRoZSBsYXRlc3QgdmVyc2lvbj8NCg0KVGhhbmtzLA0KTWljaA0KDQotLS0tLU9yaWdpbmFsIE1l c3NhZ2UtLS0tLQ0KRnJvbTogQmVuamFtaW4gS2FkdWsgW21haWx0bzprYWR1a0BNSVQuRURVXSAN ClNlbnQ6IE1vbmRheSwgT2N0b2JlciAxNywgMjAxNiA5OjEwIFBNDQpUbzogTWF0dCBSb2dlcnMg PG1yb2dlcnNAcmVkaGF0LmNvbT4NCkNjOiBraXR0ZW5AaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBb a2l0dGVuXSBTaGVwaGVyZCByZXZpZXc6IGRyYWZ0LWlldGYta2l0dGVuLXBraW5pdC1mcmVzaG5l c3MtMDcNCg0KT24gTW9uLCAxNyBPY3QgMjAxNiwgTWF0dCBSb2dlcnMgd3JvdGU6DQoNCj4gSGks DQo+DQo+IER1cmluZyBteSByZXZpZXcgb2YgZHJhZnQtaWV0Zi1raXR0ZW4tcGtpbml0LWZyZXNo bmVzcy0wNywgdGhlIGlkbml0cyANCj4gY2hlY2tlciBicm91Z2h0IHVwIHRoZSBmb2xsb3dpbmcg aXNzdWVzOg0KPg0KPiDCoENoZWNraW5nIG5pdHMgYWNjb3JkaW5nIHRvIGh0dHA6Ly93d3cuaWV0 Zi5vcmcvaWQtaW5mby9jaGVja2xpc3QgOg0KPiDCoCAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQo+IC0tLS0tLS0tLQ0K Pg0KPiDCoCAqKiBUaGUgYWJzdHJhY3Qgc2VlbXMgdG8gY29udGFpbiByZWZlcmVuY2VzIChbUkZD NDU1Nl0pLCB3aGljaCBpdA0KPiDCoMKgwqDCoMKgc2hvdWxkbid0LsKgwqBQbGVhc2UgcmVwbGFj ZSB0aG9zZSB3aXRoIHN0cmFpZ2h0IHRleHR1YWwgbWVudGlvbnMgDQo+IG9mIHRoZQ0KPiDCoMKg wqDCoMKgZG9jdW1lbnRzIGluIHF1ZXN0aW9uLg0KPg0KPg0KPiDCoCBNaXNjZWxsYW5lb3VzIHdh cm5pbmdzOg0KPiDCoCAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQo+IC0tLS0tLS0tLQ0KPg0KPiDCoCAtLSBUaGUgZG9j dW1lbnQgZGF0ZSAoTWF5IDIzLCAyMDE2KSBpcyAxNDcgZGF5cyBpbiB0aGUgcGFzdC7CoMKgSXMg DQo+IHRoaXMNCj4gwqDCoMKgwqDCoGludGVudGlvbmFsPw0KDQoNClRoZXNlIHR3byBzZWVtIHRv IGJlIHZhbGlkIHdhcm5pbmdzLCB0aG91Z2ggdGhlICIxNDcgZGF5cyBpbiB0aGUgcGFzdCIgaXMg bW9zdGx5IGp1c3QgdGhlIGNoYWlycycgZmF1bHQuDQoNCj4gwqAgQ2hlY2tpbmcgcmVmZXJlbmNl cyBmb3IgaW50ZW5kZWQgc3RhdHVzOiBQcm9wb3NlZCBTdGFuZGFyZA0KPiDCoCAtLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t DQo+IC0tLS0tLS0tLQ0KPg0KPiDCoMKgwqDCoMKgKFNlZSBSRkNzIDM5NjcgYW5kIDQ4OTcgZm9y IGluZm9ybWF0aW9uIGFib3V0IHVzaW5nIG5vcm1hdGl2ZSANCj4gcmVmZXJlbmNlcw0KPiDCoMKg wqDCoMKgdG8gbG93ZXItbWF0dXJpdHkgZG9jdW1lbnRzIGluIFJGQ3MpDQo+DQo+IMKgIC0tIExv b2tzIGxpa2UgYSByZWZlcmVuY2UsIGJ1dCBwcm9iYWJseSBpc24ndDogJzAnIG9uIGxpbmUgMjI0 DQo+IMKgwqDCoMKgwqAnY3VzZWPCoMKgwqDCoMKgwqDCoMKgWzBdIElOVEVHRVIgKDAuLjk5OTk5 OSksLi4uJw0KDQpUaGUgaWRuaXRzIGNoZWNrZXIgZG9lc24ndCBsaWtlIG91ciBBU04uMSBleHBs aWNpdCB0YWcgdmFsdWVzOyB0aGVyZSdzIG5vdGhpbmcgd2UgY2FuIGRvIG90aGVyIHRoYW4gaWdu b3JlIHRoZSBuaXRzIGFsZXJ0cy4NCg0KPiDCoCA9PSBNaXNzaW5nIFJlZmVyZW5jZTogJ1RoaXMg UkZDJyBpcyBtZW50aW9uZWQgb24gbGluZSAyNjEsIGJ1dCBub3QNCj4gwqDCoMKgwqDCoGRlZmlu ZWQNCj4gJ3wgMTUwwqDCoHwgUEFfQVNfRlJFU0hORVNTIHwgW1RoaXMgUkZDXSB8Li4uJw0KDQpU aGlzIG9uZSBjYW4gcHJvYmFibHkgYmUgaWdub3JlZCBhcyB3ZWxsLiAgVGhlcmUgbWlnaHQgYmUg c29tZSBtYWdpYyB0ZXh0IHRoYXQgd2lsbCBoYXZlIHRoZSBpZG5pdHMgY2hlY2tlciBpZ25vcmUg dGhlIHNlbGYtcmVmZXJlbmNlLCBidXQgSSBkb24ndCBrbm93IHdoYXQgaXQgaXMuDQoNCj4gwqAg KiogRG93bnJlZjogTm9ybWF0aXZlIHJlZmVyZW5jZSB0byBhbiBJbmZvcm1hdGlvbmFsIFJGQzog UkZDIDUzNDkNCj4NCj4NCj4gwqDCoMKgwqDCoFN1bW1hcnk6IDIgZXJyb3JzICgqKiksIDAgZmxh d3MgKH5+KSwgMSB3YXJuaW5nICg9PSksIDYgY29tbWVudHMgDQo+ICgtLSkuDQo+DQo+IEFuIHVw ZGF0ZWQgZG9jdW1lbnQgd2l0aCB0aGVzZSBjb3JyZWN0aW9ucywgb3Igc29tZSBjb21tZW50cyBv biB0aGVzZSANCj4gZm9yIGp1c3RpZmljYXRpb24gb2YgbGVhdmluZyB0aGVtIGJlIHdvdWxkIGJl IGhlbHBmdWwuDQoNCkFuIHVwZGF0ZWQgZG9jdW1lbnQgd291bGQgYmUgbmljZSwgYnV0IHRoZSBu ZWVkZWQgY2hhbmdlcyBhcmUgc21hbGwgZW5vdWdoIHRoYXQgaW4gbXkgb3BpbmlvbiB0aGV5IGNv dWxkIGJlIGxlZnQgYXMgUkZDIEVkaXRvciBub3Rlcy4NCg0KLUJlbg0K From nobody Wed Oct 19 00:36:09 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A40CA129545 for ; Wed, 19 Oct 2016 00:36:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.353 X-Spam-Level: X-Spam-Status: No, score=-7.353 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.431, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IDmnAmKPdNlj for ; Wed, 19 Oct 2016 00:36:04 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9AF2012950A for ; Wed, 19 Oct 2016 00:36:04 -0700 (PDT) Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 205AF8124F; Wed, 19 Oct 2016 07:36:04 +0000 (UTC) Received: from pspacek.brq.redhat.com (ovpn-204-89.brq.redhat.com [10.40.204.89]) by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u9J7a1Cx017665 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 19 Oct 2016 03:36:03 -0400 To: Greg Hudson , Matt Rogers , kitten@ietf.org References: <1476305214.14318.20.camel@redhat.com> <5f14f0d2-815f-5f46-0bbe-037aa906d2ae@mit.edu> From: Petr Spacek Organization: Red Hat Message-ID: <30a602ca-d4be-0687-b946-5353ab1ce166@redhat.com> Date: Wed, 19 Oct 2016 09:36:01 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <5f14f0d2-815f-5f46-0bbe-037aa906d2ae@mit.edu> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.68 on 10.5.11.27 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Wed, 19 Oct 2016 07:36:04 +0000 (UTC) Archived-At: Subject: Re: [kitten] Service discovery URI field case-sensitivity X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Oct 2016 07:36:05 -0000 On 13.10.2016 17:28, Greg Hudson wrote: > On 10/12/2016 04:46 PM, Matt Rogers wrote: >> The service discovery draft needs some clarification of the encoding >> and case sensitivity for the URI field values, and I have heard some >> different views on how they should be defined. > > This is in reference to draft-mccallum-kitten-krb-service-discovery-03. > >> First I believe the scheme should be case-insensitive per BCP 35 advice >> on URI scheme values. > > Our scheme, "krb5srv"? Formally, I'm not sure if we have to specify > that when defining a new scheme, but informally we should recommend that > URI record processing code match the scheme case-insensitively. > > The scheme in the transport-info for kkdcp should also be matched > case-insensitively, of course. > >> Overall my preference would be to define in their respective sections, >> the scheme, flags, and transport-type fields as case-insensitive and >> say the transport-info field's case rules are to determined by the >> transport specification. Although this limits the flags, If we really >> ran out of flags in the future then the document could be updated. > > Agreed. It's unlikely that we will ever add a second flag; it's > vanishingly unlikely that we will need more than 26 (or 36 with digits, > or whatever). I'm okay with this proposal. Take my previous notes on case sensitivity just as wondering out loud. -- Petr^2 Spacek From nobody Wed Oct 19 12:25:41 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B9BA112967B; Wed, 19 Oct 2016 12:25:36 -0700 (PDT) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.35.0 Auto-Submitted: auto-generated Precedence: bulk Sender: Message-ID: <147690513673.5770.15870729796797464865.idtracker@ietfa.amsl.com> Date: Wed, 19 Oct 2016 12:25:36 -0700 Archived-At: Cc: kitten@ietf.org, mrogers@redhat.com, kitten-chairs@ietf.org, draft-ietf-kitten-rfc6112bis@ietf.org Subject: [kitten] Last Call: (Anonymity Support for Kerberos) to Proposed Standard X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Reply-To: ietf@ietf.org List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Oct 2016 19:25:37 -0000 The IESG has received a request from the Common Authentication Technology Next Generation WG (kitten) to consider the following document: - 'Anonymity Support for Kerberos' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2016-11-02. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This document defines extensions to the Kerberos protocol to allow a Kerberos client to securely communicate with a Kerberos application service without revealing its identity, or without revealing more than its Kerberos realm. It also defines extensions that allow a Kerberos client to obtain anonymous credentials without revealing its identity to the Kerberos Key Distribution Center (KDC). This document updates RFCs 4120, 4121, and 4556. This document obsoletes RFC 6112 and reclassifies that document as historic. RFC 6112 contained errors and the protocol described in that specification is not interoperable with any known implementation. This specification describes a protocol that interoperates with multiple implementations. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-kitten-rfc6112bis/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-kitten-rfc6112bis/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Thu Oct 20 08:08:09 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id DCB0B129627; Thu, 20 Oct 2016 08:08:07 -0700 (PDT) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.35.0 Auto-Submitted: auto-generated Precedence: bulk Sender: Message-ID: <147697608790.18155.6064153394980486432.idtracker@ietfa.amsl.com> Date: Thu, 20 Oct 2016 08:08:07 -0700 Archived-At: Cc: kitten@ietf.org, mrogers@redhat.com, kitten-chairs@ietf.org, draft-ietf-kitten-pkinit-freshness@ietf.org Subject: [kitten] Last Call: (Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) Freshness Extension) to Proposed Standard X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Reply-To: ietf@ietf.org List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Oct 2016 15:08:08 -0000 The IESG has received a request from the Common Authentication Technology Next Generation WG (kitten) to consider the following document: - 'Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) Freshness Extension' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2016-11-03. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This document describes how to further extend the Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) extension [RFC4556] to exchange an opaque data blob that a KDC can validate to ensure that the client is currently in possession of the private key during a PKINIT AS exchange. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/ballot/ No IPR declarations have been submitted directly on this I-D. The document contains these normative downward references. See RFC 3967 for additional information: rfc5349: Elliptic Curve Cryptography (ECC) Support for Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) (Informational - IETF stream) Note that some of these references may already be listed in the acceptable Downref Registry. From nobody Fri Oct 21 08:44:29 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70BE212963F; Fri, 21 Oct 2016 08:44:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.33 X-Spam-Level: X-Spam-Status: No, score=-2.33 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.431] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DW5BCGzE1CDr; Fri, 21 Oct 2016 08:44:18 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26F55129608; Fri, 21 Oct 2016 08:44:15 -0700 (PDT) Received: from unnumerable.local ([47.186.56.40]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id u9LFiDOB085246 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=OK); Fri, 21 Oct 2016 10:44:13 -0500 (CDT) (envelope-from rjsparks@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host [47.186.56.40] claimed to be unnumerable.local To: General Area Review Team , kitten@ietf.org, ietf@ietf.org, draft-ietf-kitten-rfc6112bis.all@ietf.org From: Robert Sparks Message-ID: <023b4b96-77ef-a78e-3546-4d05f339d5e0@nostrum.com> Date: Fri, 21 Oct 2016 10:44:13 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------53B76364C547275E4E05545F" Archived-At: Subject: [kitten] Gen-art LC review: draft-ietf-kitten-rfc6112bis-02 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Oct 2016 15:44:19 -0000 This is a multi-part message in MIME format. --------------53B76364C547275E4E05545F Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit I am the assigned Gen-ART reviewer for this draft. The General Area Review Team (Gen-ART) reviews all IETF documents being processed by the IESG for the IETF Chair. Please treat these comments just like any other last call comments. For more information, please see the FAQ at . Document: draft-ietf-kitten-rfc6112bis-02 Reviewer: Robert Sparks Review Date: 21 Oct 2016 IETF LC End Date: 2 Nov 2016 IESG Telechat date: Not yet scheduled on a telechat Summary: Ready with nits Nits/editorial comments: Shouldn't the IANA considerations instruct IANA to update the registries at http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml to update the three rows that currently point to 6112 to point to this document instead (or at least in addition to 6112)? Micro-nit: There is a 2119 MUST carried forward from RFC6112 that could be improved if the group is willing. "Care MUST be taken by the TGS to not reveal". I would suggest "The TGS MUST NOT reveal...". If you need to further highlight care, add a sentence that says "Implementers need to be particularly careful when addressing this requirement." It is a very small nit - please feel free to ignore it. --------------53B76364C547275E4E05545F Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

I am the assigned Gen-ART reviewer for this draft. The General Area
Review Team (Gen-ART) reviews all IETF documents being processed
by the IESG for the IETF Chair.  Please treat these comments just
like any other last call comments.

For more information, please see the FAQ at

<http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.

Document: draft-ietf-kitten-rfc6112bis-02
Reviewer: Robert Sparks
Review Date: 21 Oct 2016
IETF LC End Date:  2 Nov 2016
IESG Telechat date: Not yet scheduled on a telechat

Summary: Ready with nits

Nits/editorial comments:

Shouldn't the IANA considerations instruct IANA to update the registries at http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml to update the three rows that currently point to 6112 to point to this document instead (or at least in addition to 6112)?

Micro-nit: There is a 2119 MUST carried forward from RFC6112 that could be improved if the group is willing. "Care MUST be taken by the TGS to not reveal". I would suggest "The TGS MUST NOT reveal...". If you need to further highlight care, add a sentence that says "Implementers need to be particularly careful when addressing this requirement." It is a very small nit - please feel free to ignore it.


--------------53B76364C547275E4E05545F-- From nobody Sun Oct 23 11:22:40 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C19E129567; Sun, 23 Oct 2016 11:22:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.632 X-Spam-Level: X-Spam-Status: No, score=-4.632 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.431, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SilvWjRBFNd5; Sun, 23 Oct 2016 11:22:21 -0700 (PDT) Received: from dmz-mailsec-scanner-6.mit.edu (dmz-mailsec-scanner-6.mit.edu [18.7.68.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A196712954C; Sun, 23 Oct 2016 11:22:19 -0700 (PDT) X-AuditID: 12074423-1f7ff70000002479-9d-580cffd8fe95 Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id F8.84.09337.8DFFC085; Sun, 23 Oct 2016 14:22:17 -0400 (EDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id u9NIMF6T019238; Sun, 23 Oct 2016 14:22:16 -0400 Received: from multics.mit.edu (system-low-sipb.mit.edu [18.187.2.37]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id u9NIMCeM031012 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Sun, 23 Oct 2016 14:22:15 -0400 Received: (from kaduk@localhost) by multics.mit.edu (8.12.9.20060308) id u9NIMBBa026476; Sun, 23 Oct 2016 14:22:11 -0400 (EDT) Date: Sun, 23 Oct 2016 14:22:11 -0400 (EDT) From: Benjamin Kaduk To: Robert Sparks In-Reply-To: <023b4b96-77ef-a78e-3546-4d05f339d5e0@nostrum.com> Message-ID: References: <023b4b96-77ef-a78e-3546-4d05f339d5e0@nostrum.com> User-Agent: Alpine 1.10 (GSO 962 2008-03-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrEIsWRmVeSWpSXmKPExsUixCmqrXvzP0+EQed7AYvjp9awWlx99ZnF 4tnG+SwWRzevYrG4NqeRzYHVY8mSn0wes3Y+YQlgiuKySUnNySxLLdK3S+DKeLGum7VgG0/F m9NHWRoY/3N2MXJySAiYSFzcdpC1i5GLQ0igjUmi/8J8FghnI6PE1Sl3oDKHmCSe7joA5TQw StxaupcFpJ9FQFti2tsGJhCbTUBFYuabjWwgtoiAhsS1JUvYQRqYBZoZJdqWdbGDJIQF7CXO LjsG1swJZK9f0M0MYvMKOEjMPdwH1iwkYCexteMMWL2ogI7E6v1TWCBqBCVOznwCZjMLaEks n76NZQKjwCwkqVlIUgsYmVYxyqbkVunmJmbmFKcm6xYnJ+blpRbpmunlZpbopaaUbmIEBS27 i/IOxpd93ocYBTgYlXh4T1ziiRBiTSwrrsw9xCjJwaQkyntUljtCiC8pP6UyI7E4I76oNCe1 +BCjBAezkgjvxt9A5bwpiZVVqUX5MClpDhYlcd7/bl/DhQTSE0tSs1NTC1KLYLIyHBxKErya /4AaBYtS01Mr0jJzShDSTBycIMN5gIZ7gNTwFhck5hZnpkPkTzEqSonz6oIkBEASGaV5cL3g pLKbSfUVozjQK8K8x0GqeIAJCa77FdBgJqDBgvFgg0sSEVJSDYxcDypdre3TmqVbSllDs2Q2 H518kst8k+sm6+SqyrcPuR7H8mfe3cR6IPXQu27vqleXnwtxch18fv9qplYAp8dLqw3bp7+a +e9FytH0mztdn0uHCHxju/lQeSPjmvO2Rfm+bQmH7Lbd5lqbwCQ80e/awv79rs0FjL2mgTe8 HkpHeXcaPXlbsUOJpTgj0VCLuag4EQCFWe32BQMAAA== Archived-At: Cc: kitten@ietf.org, General Area Review Team , ietf@ietf.org, draft-ietf-kitten-rfc6112bis.all@ietf.org Subject: Re: [kitten] Gen-art LC review: draft-ietf-kitten-rfc6112bis-02 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Oct 2016 18:22:23 -0000 On Fri, 21 Oct 2016, Robert Sparks wrote: > I am the assigned Gen-ART reviewer for this draft. The General Area > Review Team (Gen-ART) reviews all IETF documents being processed > by the IESG for the IETF Chair. Please treat these comments just > like any other last call comments. > > For more information, please see the FAQ at > > . > > Document: draft-ietf-kitten-rfc6112bis-02 > Reviewer: Robert Sparks > Review Date: 21 Oct 2016 > IETF LC End Date: 2 Nov 2016 > IESG Telechat date: Not yet scheduled on a telechat > > Summary: Ready with nits > > Nits/editorial comments: > > Shouldn't the IANA considerations instruct IANA to update the registries at > http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml > to update the three rows that currently point to 6112 to point to this > document instead (or at least in addition to 6112)? Yes, thanks for spotting that. > Micro-nit: There is a 2119 MUST carried forward from RFC6112 that could be > improved if the group is willing. "Care MUST be taken by the TGS to not > reveal". I would suggest "The TGS MUST NOT reveal...". If you need to further > highlight care, add a sentence that says "Implementers need to be particularly > careful when addressing this requirement." It is a very small nit - please > feel free to ignore it. That looks like a good change to me. Folks on kitten@, does anyone think otherwise? If we do not get any objections, I think we can include that in an RFC Editor Note. -Ben From nobody Mon Oct 24 14:10:17 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC53B1295E8; Mon, 24 Oct 2016 14:10:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.633 X-Spam-Level: X-Spam-Status: No, score=-4.633 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.431, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wBh47Lw1qc1a; Mon, 24 Oct 2016 14:10:13 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF5C41294B2; Mon, 24 Oct 2016 14:10:13 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id u9OLABvh014522 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 24 Oct 2016 21:10:12 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id u9OLABEH020313 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 24 Oct 2016 21:10:11 GMT Received: from abhmp0012.oracle.com (abhmp0012.oracle.com [141.146.116.18]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id u9OLA7Ps029691; Mon, 24 Oct 2016 21:10:10 GMT Received: from [10.154.112.252] (/10.154.112.252) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 24 Oct 2016 14:10:07 -0700 To: Benjamin Kaduk , Robert Sparks References: <023b4b96-77ef-a78e-3546-4d05f339d5e0@nostrum.com> From: Shawn M Emery Message-ID: <474b703b-983b-419e-9493-9eba128040a5@oracle.com> Date: Mon, 24 Oct 2016 15:12:25 -0600 User-Agent: Mozilla/5.0 (X11; SunOS i86pc; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: kitten@ietf.org, General Area Review Team , ietf@ietf.org, draft-ietf-kitten-rfc6112bis.all@ietf.org Subject: Re: [kitten] Gen-art LC review: draft-ietf-kitten-rfc6112bis-02 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Oct 2016 21:10:15 -0000 On 10/23/16 12:22 PM, Benjamin Kaduk wrote: > On Fri, 21 Oct 2016, Robert Sparks wrote: > >> I am the assigned Gen-ART reviewer for this draft. The General Area >> Review Team (Gen-ART) reviews all IETF documents being processed >> by the IESG for the IETF Chair. Please treat these comments just >> like any other last call comments. >> >> For more information, please see the FAQ at >> >> . >> >> Document: draft-ietf-kitten-rfc6112bis-02 >> Reviewer: Robert Sparks >> Review Date: 21 Oct 2016 >> IETF LC End Date: 2 Nov 2016 >> IESG Telechat date: Not yet scheduled on a telechat >> >> Summary: Ready with nits >> >> Nits/editorial comments: >> >> Shouldn't the IANA considerations instruct IANA to update the registries at >> http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml >> to update the three rows that currently point to 6112 to point to this >> document instead (or at least in addition to 6112)? > Yes, thanks for spotting that. Yes, thank you for your review. >> Micro-nit: There is a 2119 MUST carried forward from RFC6112 that could be >> improved if the group is willing. "Care MUST be taken by the TGS to not >> reveal". I would suggest "The TGS MUST NOT reveal...". If you need to further >> highlight care, add a sentence that says "Implementers need to be particularly >> careful when addressing this requirement." It is a very small nit - please >> feel free to ignore it. > That looks like a good change to me. Folks on kitten@, does anyone think > otherwise? If we do not get any objections, I think we can include that > in an RFC Editor Note. > Agreed, however I noticed another area that could use better 2119 language in regards to this. Here are the proposed updates: OLD: Care MUST be taken by the KDC not to reveal the client's identity in the authorization data of the returned ticket when populating the authorization data in a returned anonymous ticket. NEW: The KDC MUST NOT reveal the client's identity in the authorization data of the returned ticket when populating the authorization data in a returned anonymous ticket. OLD: Care MUST be taken by the TGS not to reveal the client's identity in the authorization data of the returned ticket. NEW: The TGS MUST NOT reveal the client's identity in the authorization data of the returned ticket. I have the following RFC Editor notes to date (including the above): Section: 9. Acknowledgements ----------------------------------------- OLD: 9. Acknowledgements NEW: 9. Acknowledgments Greg Hudson and Robert Sparks had provided helpful text in the bis version of the draft. Section: 10. IANA Considerations: --------------------------------------------- Please update the following Kerberos Parameters registries: Well-Known Kerberos Principal Names Well-Known Kerberos Realm Names Pre-authentication and Typed Data to reference this RFC instead of RFC6112. Shawn. -- From nobody Mon Oct 24 18:51:58 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6420129A68; Mon, 24 Oct 2016 18:51:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.632 X-Spam-Level: X-Spam-Status: No, score=-4.632 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.431, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uB9wXdzJcQEU; Mon, 24 Oct 2016 18:51:48 -0700 (PDT) Received: from dmz-mailsec-scanner-8.mit.edu (dmz-mailsec-scanner-8.mit.edu [18.7.68.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D1C1128DF6; Mon, 24 Oct 2016 18:51:47 -0700 (PDT) X-AuditID: 12074425-457ff70000004d73-96-580ebab15871 Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 46.8A.19827.1BABE085; Mon, 24 Oct 2016 21:51:46 -0400 (EDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id u9P1pikr006656; Mon, 24 Oct 2016 21:51:45 -0400 Received: from multics.mit.edu (system-low-sipb.mit.edu [18.187.2.37]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id u9P1pfJ5015336 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 24 Oct 2016 21:51:43 -0400 Received: (from kaduk@localhost) by multics.mit.edu (8.12.9.20060308) id u9P1peqE025465; Mon, 24 Oct 2016 21:51:40 -0400 (EDT) Date: Mon, 24 Oct 2016 21:51:39 -0400 (EDT) From: Benjamin Kaduk To: Shawn M Emery In-Reply-To: <474b703b-983b-419e-9493-9eba128040a5@oracle.com> Message-ID: References: <023b4b96-77ef-a78e-3546-4d05f339d5e0@nostrum.com> <474b703b-983b-419e-9493-9eba128040a5@oracle.com> User-Agent: Alpine 1.10 (GSO 962 2008-03-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpnleLIzCtJLcpLzFFi42IR4hTV1t20iy/CYPpaTovjp9awWlx99ZnF 4tnG+SwWRzevYrG4NqeRzaLv9SF2BzaPJUt+MnnM2vmExePj01ssAcxRXDYpqTmZZalF+nYJ XBkNr3kKFrBXLLjewNbAeJe1i5GTQ0LAROL3y+NANheHkEAbk8TxxhcsEM5GRolDPzayQTiH mCS2nl7FCOE0MEr0nmwG62cR0JaYubiJBcRmE1CRmPkGpIOTQ0RAS+JGQwcTSAOzwCZGiVf3 TjKDJIQF7CXOLjsG1sApYCfR9fMOUBEHB6+Ag8TRLqg7ljJK7LlwmB2kRlRAR2L1/ilg9bwC ghInZz4Bs5mBFiyfvo1lAqPALCSpWUhSCxiZVjHKpuRW6eYmZuYUpybrFicn5uWlFula6OVm luilppRuYgSFMbuL6g7GOX+9DjEKcDAq8fAyGPBFCLEmlhVX5h5ilORgUhLlnbkJKMSXlJ9S mZFYnBFfVJqTWnyIUYKDWUmE13cjUI43JbGyKrUoHyYlzcGiJM773+1ruJBAemJJanZqakFq EUxWhoNDSYJ3506gRsGi1PTUirTMnBKENBMHJ8hwHqDhMiA1vMUFibnFmekQ+VOMuhwLftxe yyTEkpeflyolznsTpEgApCijNA9uDjj97GZSfcUoDvSWMG8GSBUPMHXBTXoFtIQJaIlgPA/I kpJEhJRUAyNTUYng6sxJpkV5FyuzTP61/XtwPNWmfNLSc9PfTeWy/xdaP/vKKT+TsN/M0z9U ZN92/Fb51dKmRsjYsK24xsr61+mT7KyvPH33xHtbXAhhXecrcXuvj6ODfulO3YLbswUzk0xO tNxqjF6Xway5KSCrqin+oeACGSeO1D9KR29eKrO9fiZNT4mlOCPRUIu5qDgRAPm3SKUaAwAA Archived-At: Cc: kitten@ietf.org, General Area Review Team , draft-ietf-kitten-rfc6112bis.all@ietf.org, ietf@ietf.org, Robert Sparks Subject: Re: [kitten] Gen-art LC review: draft-ietf-kitten-rfc6112bis-02 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Oct 2016 01:51:50 -0000 On Mon, 24 Oct 2016, Shawn M Emery wrote: > > Agreed, however I noticed another area that could use better 2119 language in > regards to this. Here are the proposed updates: > > OLD: > Care MUST be taken by the KDC not to reveal the client's identity in the > authorization data of the returned ticket when populating the authorization > data in a returned anonymous ticket. > NEW: > The KDC MUST NOT reveal the client's identity in the authorization data of the > returned ticket when populating the authorization data in a returned anonymous > ticket. > > OLD: > Care MUST be taken by the TGS not to reveal the client's identity in the > authorization data of the returned ticket. > NEW: > The TGS MUST NOT reveal the client's identity in the authorization data of the > returned ticket. Those do look like parallel constructions that should get the same treatment. Thanks for spotting it. -Ben From nobody Wed Oct 26 16:58:44 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 17B84129880 for ; Wed, 26 Oct 2016 16:58:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.333 X-Spam-Level: X-Spam-Status: No, score=-7.333 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.431, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RipChiBF6Nvw for ; Wed, 26 Oct 2016 16:58:40 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AD477129625 for ; Wed, 26 Oct 2016 16:58:40 -0700 (PDT) Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 6EC918124D for ; Wed, 26 Oct 2016 23:58:25 +0000 (UTC) Received: from rei.prd.blackhats.net.au (ovpn-116-15.phx2.redhat.com [10.3.116.15]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u9QNwMeb031196 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Wed, 26 Oct 2016 19:58:24 -0400 Message-ID: <1477526302.5137.1.camel@redhat.com> From: William Brown To: "kitten@ietf.org" Date: Thu, 27 Oct 2016 09:58:22 +1000 In-Reply-To: <1473128531.15290.4.camel@redhat.com> References: <1473028515.26123.44.camel@redhat.com> <900064F9-C173-49DE-9973-F7CE6A3762EE@padl.com> <1473128531.15290.4.camel@redhat.com> Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature"; boundary="=-o7hI0iBfFfHMjIW9EmHw" Mime-Version: 1.0 X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Wed, 26 Oct 2016 23:58:25 +0000 (UTC) Archived-At: Subject: Re: [kitten] Request for feedback: draft-wibrown-ldapssotoken X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Oct 2016 23:58:42 -0000 --=-o7hI0iBfFfHMjIW9EmHw Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 2016-09-06 at 12:22 +1000, William Brown wrote: > On Mon, 2016-09-05 at 11:31 +1000, Luke Howard wrote: > > Hi William, > >=20 > > It would be worth mentioning in a Security Considerations section that = this protocol (like all bearer tokens) is vulnerable to replay attacks. > >=20 >=20 > Thank you, this is a excellent point. I have added this section and > updated the draft. >=20 >=20 Hi, As mentioned I have updated this draft. I would appreciate further comments and review. https://tools.ietf.org/html/draft-wibrown-ldapssotoken-01 --=20 Sincerely, William Brown Software Engineer Red Hat, Brisbane --=-o7hI0iBfFfHMjIW9EmHw Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQIcBAABAgAGBQJYEUMeAAoJEISUiynM+PAgsVIQAM55dMU40IrAByoqxNXCJ8f6 C5uR4QPkh5ggKZ60+FX1zum0kNxvNbRuvMyW5VdytMhdiXejrjXDUuomnxhloOCr gZrhC5HzgeEUbXPPJqfCu6wL+Eu61eFjOCShc2GcpE1jKSZ2eafcwCuQd7HcuybB jDBxsAoa31cTEGlrt1LElabtFk+xBbAFHMkZFXhBtAJoSVQfmYMdZWvEsgaESsYi Br5JwD901La0GQUIZxHPWIefmFNskdiAMLt/XVnzK3ncuFLuI4IUguwECMrpXBAx zmHyyOaLfKzWmrWq3rnemx02WUYlWcNHeRMXnzWygWtMU57UZ8iuy5vgqRsnph52 u5XX0Jvu6Wmc+0P5/ocQIZUuRroDkANQzzgtiKNFDgrfStC+MP2BuT3z50nRpC24 nUwo7e/5kI5YK2v2ZXHQwVhAjzyl87+EMqAHV1xpDNw3V7601n82CyDbX3e5MLx0 jLrY3uD81XwK/8xoVu4Sd9bmzROaTPIZ2UZas4V1iaWZSbbsaUk6OfrbkE2Shnka 70crZMIzoPzT9xVnLBgDWDHJs9l8C2YH9fMY4wHn0iLohojMneHpUOVUO6c5O19W uqPVWFJl9HewMsVBypQop12Yu05gVqHVBcMc0ipg4QhjyvEO4V6TSk+VJsFI4JvT GN2+7z1MOPBV7KjTsCcM =GSZ4 -----END PGP SIGNATURE----- --=-o7hI0iBfFfHMjIW9EmHw-- From nobody Thu Oct 27 22:29:46 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E0E8129631; Thu, 27 Oct 2016 22:29:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.033 X-Spam-Level: X-Spam-Status: No, score=-103.033 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.431, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r0NI3N40ACw4; Thu, 27 Oct 2016 22:29:37 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 199A91296A8; Thu, 27 Oct 2016 22:29:36 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id DD790B81236; Thu, 27 Oct 2016 22:29:35 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Message-Id: <20161028052935.DD790B81236@rfc-editor.org> Date: Thu, 27 Oct 2016 22:29:35 -0700 (PDT) Archived-At: Cc: kitten@ietf.org, drafts-update-ref@iana.org, rfc-editor@rfc-editor.org Subject: [kitten] RFC 8009 on AES Encryption with HMAC-SHA2 for Kerberos 5 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Oct 2016 05:29:44 -0000 A new Request for Comments is now available in online RFC libraries. RFC 8009 Title: AES Encryption with HMAC-SHA2 for Kerberos 5 Author: M. Jenkins, M. Peck, K. Burgin Status: Informational Stream: IETF Date: October 2016 Mailbox: mjjenki@tycho.ncsc.mil, mpeck@mitre.org, kelley.burgin@gmail.com Pages: 19 Characters: 34935 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-kitten-aes-cts-hmac-sha2-11.txt URL: https://www.rfc-editor.org/info/rfc8009 DOI: http://dx.doi.org/10.17487/RFC8009 This document specifies two encryption types and two corresponding checksum types for Kerberos 5. The new types use AES in CTS mode (CBC mode with ciphertext stealing) for confidentiality and HMAC with a SHA-2 hash for integrity. This document is a product of the Common Authentication Technology Next Generation Working Group of the IETF. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC