From nobody Thu Dec 1 00:42:00 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5002129C32; Thu, 1 Dec 2016 00:41:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.796 X-Spam-Level: X-Spam-Status: No, score=-4.796 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-2.896] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Y0cBCAMDUgN; Thu, 1 Dec 2016 00:41:52 -0800 (PST) Received: from p130.piuha.net (p130.piuha.net [IPv6:2a00:1d50:2::130]) by ietfa.amsl.com (Postfix) with ESMTP id 3599C1295A0; Thu, 1 Dec 2016 00:41:39 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id 845B82CCAE; Thu, 1 Dec 2016 10:41:08 +0200 (EET) (envelope-from jari.arkko@piuha.net) X-Virus-Scanned: amavisd-new at piuha.net Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LgJkGFT8fa6t; Thu, 1 Dec 2016 10:41:08 +0200 (EET) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2a00:1d50:2::130]) by p130.piuha.net (Postfix) with ESMTP id 089F22CC95; Thu, 1 Dec 2016 10:41:08 +0200 (EET) (envelope-from jari.arkko@piuha.net) Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Content-Type: multipart/signed; boundary="Apple-Mail=_83C8C3B5-6B5C-4D2E-A287-F85D275E617F"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail From: Jari Arkko In-Reply-To: <080f0fa3-11de-ac58-3b67-9bda3e788d89@nostrum.com> Date: Thu, 1 Dec 2016 10:41:07 +0200 Message-Id: <02822A4B-B944-43CA-9119-ECF6FE112858@piuha.net> References: <023b4b96-77ef-a78e-3546-4d05f339d5e0@nostrum.com> <080f0fa3-11de-ac58-3b67-9bda3e788d89@nostrum.com> To: Robert Sparks X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: kitten@ietf.org, General Area Review Team , ietf@ietf.org, draft-ietf-kitten-rfc6112bis.all@ietf.org Subject: Re: [kitten] Gen-art Telechat review: draft-ietf-kitten-rfc6112bis-03 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 08:41:55 -0000 --Apple-Mail=_83C8C3B5-6B5C-4D2E-A287-F85D275E617F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Thanks for your review, Robert, and thanks everyone for addressing the = earlier comments. Jari --Apple-Mail=_83C8C3B5-6B5C-4D2E-A287-F85D275E617F Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJYP+IjAAoJEM80gCTQU46qc48P/RuYvCPzMiHOZLxJB38NoIkA 4+7/EymKOceYtEIwFeI45gXf3MaZ66j4Ipule20Zm2iO0qsThLAdK1vnr7Y7Yzzv yuCAJfJacuTtEahPsKV9Z3C34SIniw3x8xQpi5X9cE1yeO6Re2dyPvtTROB1/E2W 9lv0rdQF5cKtrAWvBNRj7Mwk+frEN0KegCry4j6Sh4f04l8RGSHO3DGenFfCYNvx pws6eG0qL8yt5zuWtKTOGSUCOZqSvXPeNuQx5czvIOFIcVZaOe2t5EoihI134dmq ObGB5nAfNVS/KR8JcXAU2We3rtLFNVsLnEMmfyzPuYrh8yNxQcyKT56/kpwXqEAA tZxL7b1BtCaUVkyS62fb/24nFPanvMSvfXx4fDCUYIJSUsRI3X+8Uay93H3bKeoA iKazbpcwvNs2939Ca2X+JaHMwWWEEuw6VViz+8wKR1IcJ1V4XwvR3LyreHTfOVB2 e5iI0J7S81vQmBlSR8aZw7USkvst4fPjVAMd6y0K1EX5EsMstDR0TAJCeZ1QTz1p qU0YGwiPP5YtV183V6s1mgAm9hoUgNHL7zxI1rjUN82ebnjNWudIwZcyUZIsxh6i DNrb2I4QF22XdTPwpM19+yK7/N1U6zV+kBmsRogUYITP+bszLETDs3zd17vew8UM utboP/eyvhGj6hDr2f02 =OQ51 -----END PGP SIGNATURE----- --Apple-Mail=_83C8C3B5-6B5C-4D2E-A287-F85D275E617F-- From nobody Thu Dec 1 01:29:09 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B4B00129F36; Thu, 1 Dec 2016 01:29:03 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "Jari Arkko" To: "The IESG" X-Test-IDTracker: no X-IETF-IDTracker: 6.39.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148058454371.10318.13833993922629313553.idtracker@ietfa.amsl.com> Date: Thu, 01 Dec 2016 01:29:03 -0800 Archived-At: Cc: mrogers@redhat.com, kitten@ietf.org, kitten-chairs@ietf.org, housley@vigilsec.com, draft-ietf-kitten-pkinit-freshness@ietf.org Subject: [kitten] Jari Arkko's Discuss on draft-ietf-kitten-pkinit-freshness-07: (with DISCUSS and COMMENT) X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 09:29:04 -0000 Jari Arkko has entered the following ballot position for draft-ietf-kitten-pkinit-freshness-07: Discuss When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/ ---------------------------------------------------------------------- DISCUSS: ---------------------------------------------------------------------- I am concerned about the issue that Russ Housley raised in his Gen-ART review: bad practices in creating the freshness tokens creates a security issue. If this cannot be handled in the way that Russ initially suggested (setting a minimum number of bits) then a proper discussion of the issue and recommendations to avoid the problems need to be included in the security considerations section. ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Other issues from Russ' Gen-ART review should also be addressed (editorial ones + possible max size). From nobody Thu Dec 1 03:33:13 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1163D129637; Thu, 1 Dec 2016 03:33:11 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "Benoit Claise" To: "The IESG" X-Test-IDTracker: no X-IETF-IDTracker: 6.39.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148059199104.10398.5094960037726749512.idtracker@ietfa.amsl.com> Date: Thu, 01 Dec 2016 03:33:11 -0800 Archived-At: Cc: mrogers@redhat.com, kitten@ietf.org, kitten-chairs@ietf.org, sob@sobco.com, draft-ietf-kitten-pkinit-freshness@ietf.org Subject: [kitten] Benoit Claise's No Objection on draft-ietf-kitten-pkinit-freshness-07: (with COMMENT) X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 11:33:11 -0000 Benoit Claise has entered the following ballot position for draft-ietf-kitten-pkinit-freshness-07: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- As mentioned by Scott Bradner in his OPS-DIR review, some words about operational guidance (not implementation guidance) would be welcome: " what kind of message could the operator give to their users to minimize the disruption when errors start popping up " would be welcome. See https://www.ietf.org/mail-archive/web/ops-dir/current/msg02267.html. From nobody Thu Dec 1 09:55:41 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD23B12967C for ; Thu, 1 Dec 2016 09:55:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Qt7CKh0-gNl for ; Thu, 1 Dec 2016 09:55:35 -0800 (PST) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0113.outbound.protection.outlook.com [104.47.34.113]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E3BA12969E for ; Thu, 1 Dec 2016 09:55:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=79EGbnZf/T+Zl4cXBWrLz91pxki8SzbhJm5fKQhYGgg=; b=KUKowo0u1hUoVWH59AZRA6bBsaZiZN200AWPixFr8KpGK837qawt+4DesHKwHtCAh7oI7jiKhQl8SgrtujcuwE0cK/KrWIs6RYNh6WUACyofdFqUCv4k2qrT49tsGpAhN7vO+5vUKjRB4S23T7KGar1tWaNH1VKF0vP/8E44cbQ= Received: from CY1PR03MB2315.namprd03.prod.outlook.com (10.166.207.138) by CY1PR03MB2315.namprd03.prod.outlook.com (10.166.207.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.734.8; Thu, 1 Dec 2016 17:55:34 +0000 Received: from CY1PR03MB2315.namprd03.prod.outlook.com ([10.166.207.138]) by CY1PR03MB2315.namprd03.prod.outlook.com ([10.166.207.138]) with mapi id 15.01.0734.020; Thu, 1 Dec 2016 17:55:34 +0000 From: Michiko Short To: "kitten@ietf.org" Thread-Topic: Freshness Security Considerations for minimum/maximum size Thread-Index: AdJL+WK9inTSuXD+SZmasY5nwhJ7MA== Date: Thu, 1 Dec 2016 17:55:34 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=michikos@microsoft.com; x-originating-ip: [2001:4898:80e8:d::3a6] x-microsoft-exchange-diagnostics: 1; CY1PR03MB2315; 7:5zHw76fetWOFG4hR9EVQ1Wr1zxTQUVb6XLUN2Pysq/iW3XYeFMLIfkslwN+vnk9h0HsFoU6sgF/Re6lxNucQqbB/vbZZ0zpxQEuK5e24dWs03lVdX+gGnRGaWO905eiGcHK10tQEGLJm08qd2P8EdJwRE0PjOxZTGBNxzedg5ishCuhqYya9Ko4JJAzxeJoMtFz4lne8Ha944wVyhA3j9p9aXZnzlpAOoTWJPjSrOYAlABrvbCOWCF2y2macT4MnRJJTNp3DMv91+UBHlixdFlV/iYcWurgp+7GeMn1RHYaPgSTLmTgfAVAB1FDsuNLQPREXJhzN3CbGjsmfwlUWQQboYXVX/HEK1FFXbqeKIJCEZYPiZZS/gw/qaw4L0ECD x-ms-office365-filtering-correlation-id: 47e081fd-97a7-4ce9-c400-08d41a133fd6 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:CY1PR03MB2315; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123564025)(20161123560025)(20161123555025)(6072148)(6047074); SRVR:CY1PR03MB2315; BCL:0; PCL:0; RULEID:; SRVR:CY1PR03MB2315; x-forefront-prvs: 014304E855 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(199003)(189002)(76576001)(3660700001)(2900100001)(77096006)(8990500004)(38730400001)(5005710100001)(450100001)(10290500002)(81156014)(107886002)(8676002)(92566002)(39410400001)(7110500001)(39450400002)(81166006)(1730700003)(6506003)(8936002)(101416001)(6916009)(97736004)(189998001)(122556002)(9686002)(7696004)(86362001)(2906002)(54356999)(6116002)(790700001)(33656002)(105586002)(102836003)(2351001)(99286002)(106356001)(110136003)(86612001)(50986999)(5640700001)(5630700001)(7736002)(5660300001)(15650500001)(2501003)(10090500001)(74316002)(7846002)(68736007)(2420400007)(3280700002)(10710500007); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR03MB2315; H:CY1PR03MB2315.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR03MB2315AC54FFAF0CC292EBDD71D08F0CY1PR03MB2315namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Dec 2016 17:55:34.2781 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR03MB2315 Archived-At: Subject: [kitten] Freshness Security Considerations for minimum/maximum size X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 17:55:39 -0000 --_000_CY1PR03MB2315AC54FFAF0CC292EBDD71D08F0CY1PR03MB2315namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable We have concerns about the lack of guidance about size of the freshness tok= en. Minimum length Problematic due to the fact that we intentionally did not specify the forma= t of the freshness token. Since the structure of the freshness token is le= ft up to the KDC, there is no good way to determine a minimum size. Howeve= r, we can add to the security considerations: Although we don't specify the format of the freshness token, there are a fe= w size considerations based on if the following are used: - Nonce: Size is determined by the birthday problem. - Symmetric cryptography: Size is determined by properties of the = encryption types supported. - Asymmetric cryptography: Size is determined by properties of the= encryption types supported. Maximum length A maximum size makes sense as a way to avoid processing messages that are c= learly bad. Is there an accepted value for a worst case CMS signature? --_000_CY1PR03MB2315AC54FFAF0CC292EBDD71D08F0CY1PR03MB2315namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

We have concerns about the lack of guidance about si= ze of the freshness token.

 

Minimum length

Problematic due to the fact that we intentionally= did not specify the format of the freshness token.  Since the structu= re of the freshness token is left up to the KDC, there is no good way to de= termine a minimum size.  However, we can add to the security considerations:

 

Although we don’t specify the format of the= freshness token, there are a few size considerations based on if the follo= wing are used:

-       = ;   Nonce: Size is determined by the birthday problem.<= o:p>

-       = ;   Symmetric cryptography: Size is determined by prope= rties of the encryption types supported.

-       = ;   Asymmetric cryptography: Size is determined by prop= erties of the encryption types supported.

 

Maximum length

A maximum size makes sense as a way to avoid process= ing messages that are clearly bad.  Is there an accepted value for a w= orst case CMS signature?

--_000_CY1PR03MB2315AC54FFAF0CC292EBDD71D08F0CY1PR03MB2315namp_-- From nobody Thu Dec 1 11:59:08 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF278129EF2 for ; Thu, 1 Dec 2016 11:59:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.116 X-Spam-Level: X-Spam-Status: No, score=-7.116 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6orUFgaPTv4c for ; Thu, 1 Dec 2016 11:59:05 -0800 (PST) Received: from dmz-mailsec-scanner-2.mit.edu (dmz-mailsec-scanner-2.mit.edu [18.9.25.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FF2B129D3E for ; Thu, 1 Dec 2016 11:47:00 -0800 (PST) X-AuditID: 1209190d-eebff700000009d2-a9-58407e323809 Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id D7.80.02514.23E70485; Thu, 1 Dec 2016 14:46:59 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-1.mit.edu (8.13.8/8.9.2) with ESMTP id uB1JkwxN030605; Thu, 1 Dec 2016 14:46:58 -0500 Received: from [18.101.8.122] (vpn-18-101-8-122.mit.edu [18.101.8.122]) (authenticated bits=0) (User authenticated as ghudson@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id uB1JkuuR004676 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Thu, 1 Dec 2016 14:46:57 -0500 To: Michiko Short , "kitten@ietf.org" References: From: Greg Hudson Message-ID: <3cee1ab5-8f73-fce0-58a8-36a1697c9b77@mit.edu> Date: Thu, 1 Dec 2016 14:46:56 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrJIsWRmVeSWpSXmKPExsUixCmqrGtc5xBhcOQki8XRzatYLP518zkw eSxZ8pPJo3XHX/YApigum5TUnMyy1CJ9uwSujAtTYwqus1Y8/9HJ3sB4gqWLkZNDQsBE4nfD YSYQW0igjUnibI9RFyMXkL2BUeLG1wlMEM4RJonFu3vBqoQFgiR+nGljB7FFBKIkVh1bDxTn ACqKkVi9PR8kzCagLLF+/1awBbwCVhKbH35iBrFZBFQkJrTNZAOxRQUiJG497ICqEZQ4OfMJ mM0pECvx4NF9sPHMAnoSO67/YoWw5SW2v53DPIGRfxaSlllIymYhKVvAyLyKUTYlt0o3NzEz pzg1Wbc4OTEvL7VI10gvN7NELzWldBMjOBQleXcw/rvrdYhRgINRiYf3hbFDhBBrYllxZe4h RkkOJiVR3kd6QCG+pPyUyozE4oz4otKc1OJDjBIczEoivBFVQDnelMTKqtSifJiUNAeLkjjv f7ev4UIC6YklqdmpqQWpRTBZGQ4OJQlei1qgRsGi1PTUirTMnBKENBMHJ8hwHqDhk2pAhhcX JOYWZ6ZD5E8x6nIceL/iKZMQS15+XqqUOO8XkCIBkKKM0jy4OeAUkspR9YpRHOgtYd4UkHU8 wPQDN+kV0BImoCUd1+1BlpQkIqSkGhhnXeZ/tmu3wSnlyU/vvfOdEOvS9JPDefXxQzMb2DY4 zq2+Lv5aaV/d5csT1a94ZmfMZpPnKO5+8r8pdlftQVnemEcPumfosbyb6lasbvp87WbrjScz Ti6YzX30Df/d8+dmmS96VcAeckkqquv3hCfMIcHbf80KDP3ek2FbZxZ+ZG6Vkm/uxENnlViK MxINtZiLihMBAmHr+/wCAAA= Archived-At: Subject: Re: [kitten] Freshness Security Considerations for minimum/maximum size X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 19:59:07 -0000 On 12/01/2016 12:55 PM, Michiko Short wrote: > Minimum length I think we should add a third paragraph to security considerations saying: If freshness tokens sent by the KDC are too short or too predictable, an attacker may be able to defeat the mechanism by creating signatures using every possible token value. To prevent this attack, the freshness token SHOULD contain a minimum of 64 unpredictable bits. (I am willing to accept an amendment changing 64 to 96 or 128. It's a SHOULD, so it doesn't really constrain the implementation.) > Maximum length Saying anything about maximum lengths would be out of character for Kerberos standards, I think. I don't think we should specify a maximum length. From nobody Thu Dec 1 13:10:10 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 576E9129458 for ; Thu, 1 Dec 2016 13:10:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.935 X-Spam-Level: X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YVuqWYORXDGg for ; Thu, 1 Dec 2016 13:10:07 -0800 (PST) Received: from mailout.easymail.ca (mailout.easymail.ca [64.68.201.169]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 294FF1294FA for ; Thu, 1 Dec 2016 13:08:25 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mailout.easymail.ca (Postfix) with ESMTP id 77555E3DC; Thu, 1 Dec 2016 16:08:24 -0500 (EST) Received: from mailout.easymail.ca ([127.0.0.1]) by localhost (easymail-mailout.easydns.vpn [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A+yOVb79lTGy; Thu, 1 Dec 2016 16:08:23 -0500 (EST) Received: from [192.168.3.129] (24-205-82-163.dhcp.psdn.ca.charter.com [24.205.82.163]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailout.easymail.ca (Postfix) with ESMTPSA id A0C60E3B8; Thu, 1 Dec 2016 16:08:22 -0500 (EST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\)) From: "Henry B (Hank) Hotz, CISSP" In-Reply-To: <3cee1ab5-8f73-fce0-58a8-36a1697c9b77@mit.edu> Date: Thu, 1 Dec 2016 13:08:21 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: <0ABB5934-C7E7-4DBD-B21A-3986B4DB6440@oxy.edu> References: <3cee1ab5-8f73-fce0-58a8-36a1697c9b77@mit.edu> To: Greg Hudson X-Mailer: Apple Mail (2.2104) Archived-At: Cc: "kitten@ietf.org" , Michiko Short Subject: Re: [kitten] Freshness Security Considerations for minimum/maximum size X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 21:10:08 -0000 Mildly disagree. The point is to avoid processing bogus messages. I=E2=80=99= d suggest a security consideration noting this issue and recommending = that anything too big to match any supported encryption type should be = summarily thrown away. > On Dec 1, 2016, at 11:46 AM, Greg Hudson wrote: >=20 >> Maximum length >=20 > Saying anything about maximum lengths would be out of character for > Kerberos standards, I think. I don't think we should specify a = maximum > length. Personal email. hbhotz@oxy.edu From nobody Mon Dec 5 09:08:05 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C19C0129BB7; Mon, 5 Dec 2016 09:07:55 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.39.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148095767576.3393.13872336524228407189.idtracker@ietfa.amsl.com> Date: Mon, 05 Dec 2016 09:07:55 -0800 Archived-At: Cc: mrogers@redhat.com, kitten-chairs@ietf.org, draft-ietf-kitten-rfc6112bis@ietf.org, kitten@ietf.org, The IESG , rfc-editor@rfc-editor.org Subject: [kitten] Protocol Action: 'Anonymity Support for Kerberos' to Proposed Standard (draft-ietf-kitten-rfc6112bis-03.txt) X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Dec 2016 17:07:56 -0000 The IESG has approved the following document: - 'Anonymity Support for Kerberos' (draft-ietf-kitten-rfc6112bis-03.txt) as Proposed Standard This document is the product of the Common Authentication Technology Next Generation Working Group. The IESG contact persons are Stephen Farrell and Kathleen Moriarty. A URL of this Internet Draft is: https://datatracker.ietf.org/doc/draft-ietf-kitten-rfc6112bis/ Technical Summary This document describes Kerberos extensions for client anonymity support. These extensions give Kerberos clients the ability to authenticate and securely communicate with a service, without revealing the client identity. Two methods are described; one that only reveals the client’s identity to its own KDC, and another that utilizes anonymous PKINIT to hide the client identity completely. Working Group Summary There is consensus among the WG for this document, and as a “bis” document all errata have been considered. Aside from a few editorial corrections, there are three primary changes to the specification. First, when using the anonymous PKINIT method, the ticket session key is derived using the KRB-FX-CF2 operation, which requires two input constants “pepper1” and “pepper2”. The “pepper2” constant was incorrect in RFC 6112 and has been chang ed to its correct value. Second, the need for setting the anonymous KDC flag in a anonymous TGS request changed from a MUST to a SHOULD. Third, a new paragraph has been added which clarifies a MITM scenario that is prevented by the anonymous PKINIT session-key derivation method. Document Quality This is request for publication of a Standards Track document to obsolete RFC 6112, which had technical errors that made the described extensions inoperable with existing implementations. Personnel Matt Rogers is the document shepherd. Stephen Farrell is the responsible Area Director. From nobody Mon Dec 5 15:46:28 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id BC08712962E; Mon, 5 Dec 2016 15:46:23 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.39.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148098158374.9626.6869395964350829577.idtracker@ietfa.amsl.com> Date: Mon, 05 Dec 2016 15:46:23 -0800 Archived-At: Cc: kitten@ietf.org Subject: [kitten] I-D Action: draft-ietf-kitten-rfc5653bis-04.txt X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Dec 2016 23:46:24 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Common Authentication Technology Next Generation of the IETF. Title : Generic Security Service API Version 2: Java Bindings Update Authors : Mayank D. Upadhyay Seema Malkani Wang Weijun Filename : draft-ietf-kitten-rfc5653bis-04.txt Pages : 96 Date : 2016-12-05 Abstract: The Generic Security Services Application Program Interface (GSS-API) offers application programmers uniform access to security services atop a variety of underlying cryptographic mechanisms. This document updates the Java bindings for the GSS-API that are specified in "Generic Security Service API Version 2 : Java Bindings Update" (RFC 5653). This document obsoletes RFC 5653 by adding a new output token field to the GSSException class so that when the initSecContext or acceptSecContext methods of the GSSContext class fails it has a chance to emit an error token which can be sent to the peer for debugging or informational purpose. The stream-based GSSContext methods are also removed in this version. The GSS-API is described at a language-independent conceptual level in "Generic Security Service Application Program Interface Version 2, Update 1" (RFC 2743). The GSS-API allows a caller application to authenticate a principal identity, to delegate rights to a peer, and to apply security services such as confidentiality and integrity on a per-message basis. Examples of security mechanisms defined for GSS- API are "The Simple Public-Key GSS-API Mechanism" (RFC 2025) and "The Kerberos Version 5 Generic Security Service Application Program Interface (GSS-API) Mechanism: Version 2" (RFC 4121). The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-kitten-rfc5653bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-kitten-rfc5653bis-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-kitten-rfc5653bis-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Dec 5 15:47:39 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 80F30129EA0 for ; Mon, 5 Dec 2016 15:47:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.117 X-Spam-Level: X-Spam-Status: No, score=-7.117 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zBm5q_oRoKKM for ; Mon, 5 Dec 2016 15:47:36 -0800 (PST) Received: from dmz-mailsec-scanner-2.mit.edu (dmz-mailsec-scanner-2.mit.edu [18.9.25.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AA032129627 for ; Mon, 5 Dec 2016 15:47:36 -0800 (PST) X-AuditID: 1209190d-c3fff70000004c46-60-5845fc970011 Received: from mailhub-auth-4.mit.edu ( [18.7.62.39]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 35.46.19526.79CF5485; Mon, 5 Dec 2016 18:47:35 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-4.mit.edu (8.13.8/8.9.2) with ESMTP id uB5NlYTZ010001 for ; Mon, 5 Dec 2016 18:47:34 -0500 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id uB5NlVuv009104 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Mon, 5 Dec 2016 18:47:34 -0500 Date: Mon, 5 Dec 2016 17:47:31 -0600 From: Benjamin Kaduk To: kitten@ietf.org Message-ID: <20161205234731.GB8460@kduck.kaduk.org> References: <148098158374.9626.6869395964350829577.idtracker@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <148098158374.9626.6869395964350829577.idtracker@ietfa.amsl.com> User-Agent: Mutt/1.6.1 (2016-04-27) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrIIsWRmVeSWpSXmKPExsUixG6nrjv9j2uEwap9BhZHN69icWD0WLLk J1MAYxSXTUpqTmZZapG+XQJXRtv1l0wF67kr+hbyNTBe5+hi5OCQEDCROLrVt4uRi0NIoI1J 4sL3K+wQzjFGiZs31jJDOK+YJNp/HWAH6WARUJE4sUeii5GTgw3IbOi+zAxiiwgIS+ze+g7M FhZwlXhyZz8jiM0rYCzxesF6MFtIwEdiyveVzBBxQYmTM5+wgNjMAloSN/69ZAIZzywgLbH8 H9htnAK+Etv+hINUiAooSzTMeMA8gZF/FpLmWUiaZyE0L2BkXsUom5JbpZubmJlTnJqsW5yc mJeXWqRrpJebWaKXmlK6iREUcpySvDsY/931OsQowMGoxMP7ocE1Qog1say4MvcQoyQHk5Io 78IHQCG+pPyUyozE4oz4otKc1OJDjBIczEoivPy/gHK8KYmVValF+TApaQ4WJXHe/25fw4UE 0hNLUrNTUwtSi2CyMhwcShK8F0AaBYtS01Mr0jJzShDSTBycIMN5gIZL/AYZXlyQmFucmQ6R P8WoKCXO+/QnUEIAJJFRmgfXC0oJEtn7a14xigO9IszrBNLOA0wncN2vgAYzAQ0+cdwZZHBJ IkJKqoFx4rW/73y3Gsnc37Uuc2baRWGrjW49YTePbHizYfqqhcatnfIHt/yfVH6/Lu/bgq0P bHgCpIQ+8Uc1XI9auXXe46T6ltont/w32f/58sj15/WOt9rVMr8lFnUcuLvwztaLa5ZeiPT2 Nr/f6fyDl8eqse2e9/8ageAlSRHpMctKVvAImu6yEew9pcRSnJFoqMVcVJwIAF9uPs7kAgAA Archived-At: Subject: Re: [kitten] I-D Action: draft-ietf-kitten-rfc5653bis-04.txt X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Dec 2016 23:47:38 -0000 This is just a no-change rebuild to un-expire the document. -Ben On Mon, Dec 05, 2016 at 03:46:23PM -0800, internet-drafts@ietf.org wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the Common Authentication Technology Next Generation of the IETF. > > Title : Generic Security Service API Version 2: Java Bindings Update > Authors : Mayank D. Upadhyay > Seema Malkani > Wang Weijun > Filename : draft-ietf-kitten-rfc5653bis-04.txt > Pages : 96 > Date : 2016-12-05 > [...] > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-kitten-rfc5653bis/ > > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-kitten-rfc5653bis-04 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-kitten-rfc5653bis-04 > > > Please note that it may take a couple of minutes from the time of submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > Kitten mailing list > Kitten@ietf.org > https://www.ietf.org/mailman/listinfo/kitten From nobody Mon Dec 12 14:50:34 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADDAE12951E for ; Mon, 12 Dec 2016 14:50:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.922 X-Spam-Level: X-Spam-Status: No, score=-0.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_FROM=0.999, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ilat-z6-O74y for ; Mon, 12 Dec 2016 14:50:29 -0800 (PST) Received: from mail-yw0-f180.google.com (mail-yw0-f180.google.com [209.85.161.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 477F2129E1E for ; Mon, 12 Dec 2016 14:50:29 -0800 (PST) Received: by mail-yw0-f180.google.com with SMTP id r204so73798551ywb.0 for ; Mon, 12 Dec 2016 14:50:29 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=JJBG3sSqXLMfOdKM+HRs8atTAntKLM0Q9pbpyGIu7/g=; b=Ji83+4ixVJASt1RoKXjXQCX1HKAAJg1PdfxPCwmAk6ksrwspF3BrNh2l2K20sLlvlC j4p3CXZC+0DsWWG9Lb55PbFEXsmG9akyNbo9hNMs07q8GmHvAkARxgzmrS/r3CF0mKby /bZrCqx7PTQREGN1vzw7pDe7RNAs6cY8TnWk6BTLbY34kUaiZByPRIZP28Jto9tt77s1 6R+k/ch713Z51jObvlgE7juXHA4KTyBQ3xpWbygtTAHssw/bUB3k1H2K5clhz+w1BR4t +HJjU+ZG6jeDyjF6+6HzMIFklvTrG/F0Hovbp3OVyWcG+Vd9Lrfzstnyb7EFTWeBVMq2 Q3eA== X-Gm-Message-State: AKaTC00eJo/p/1W3RkhuwbsT6dakurODoY+O3QkPAx5Xv0owuiW30bDuvGoPNBwhNWnJ0DsGg1oHu6ywzNb8vovE X-Received: by 10.13.220.1 with SMTP id f1mr90878567ywe.1.1481583028445; Mon, 12 Dec 2016 14:50:28 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.163.77 with HTTP; Mon, 12 Dec 2016 14:50:28 -0800 (PST) From: Nathaniel McCallum Date: Mon, 12 Dec 2016 17:50:28 -0500 Message-ID: To: kitten@ietf.org Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [kitten] New SPAKE Preauthentication Draft X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Dec 2016 22:50:32 -0000 https://datatracker.ietf.org/doc/draft-mccallum-kitten-krb-spake-preauth/ There have been many updates to the draft over the last year. I believe this latest draft has incorporated all of the previous suggestions. We have made many other improvements as well. Work has begun implementing this draft in the MIT codebase. From nobody Mon Dec 12 21:03:47 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A409A129860 for ; Mon, 12 Dec 2016 21:03:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.117 X-Spam-Level: X-Spam-Status: No, score=-7.117 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4p0WcCTDQWcJ for ; Mon, 12 Dec 2016 21:03:44 -0800 (PST) Received: from dmz-mailsec-scanner-7.mit.edu (dmz-mailsec-scanner-7.mit.edu [18.7.68.36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D219129863 for ; Mon, 12 Dec 2016 21:03:44 -0800 (PST) X-AuditID: 12074424-ac3ff70000007f07-d1-584f812d10b8 Received: from mailhub-auth-2.mit.edu ( [18.7.62.36]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 63.04.32519.D218F485; Tue, 13 Dec 2016 00:03:41 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-2.mit.edu (8.13.8/8.9.2) with ESMTP id uBD53egp028457 for ; Tue, 13 Dec 2016 00:03:41 -0500 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id uBD53bi1026408 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 13 Dec 2016 00:03:40 -0500 Date: Mon, 12 Dec 2016 23:03:37 -0600 From: Benjamin Kaduk To: kitten@ietf.org Message-ID: <20161213050337.GB8460@kduck.kaduk.org> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.1 (2016-04-27) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrIIsWRmVeSWpSXmKPExsUixG6noqvb6B9h8OObtMXRzatYHBg9liz5 yRTAGMVlk5Kak1mWWqRvl8CV0bVyOnPBVfaKFe/+MTcwLmbrYuTkkBAwkZj1djprFyMXh5BA G5PEi3efWSCc44wSvz8thMq8ZpLo/9nKCtLCIqAqsfT1VmYQm01ARaKh+zKYLSIgLLF76zsw W1jAXGLqrQZGEJtXwFiirecnE4gtJBAg8ff0NFaIuKDEyZlPWEBsZgEtiRv/XgLVcADZ0hLL /3GAhDkFAiV2PlwLNlJUQFmiYcYD5gmM/LOQdM9C0j0LoXsBI/MqRtmU3Crd3MTMnOLUZN3i 5MS8vNQiXXO93MwSvdSU0k2M4NBzUdnB2N3jfYhRgINRiYdXYJNfhBBrYllxZe4hRkkOJiVR 3s/V/hFCfEn5KZUZicUZ8UWlOanFhxglOJiVRHgf1QPleFMSK6tSi/JhUtIcLErivJcy3SOE BNITS1KzU1MLUotgsjIcHEoSvE9BGgWLUtNTK9Iyc0oQ0kwcnCDDeYCGfwQbXlyQmFucmQ6R P8Woy3Hg/YqnTEIsefl5qVLivL4gRQIgRRmleXBzQClDInt/zStGcaC3hHk/gVTxANMN3KRX QEuYgJY83+cNsqQkESEl1cDYzyztXFxVG9kn8rznbfX+uIW2ur4ueX3ffQs8r9vzyETxNXL0 tYV/qd4zdaKU0V+1r+2tUh+sdlZXZbldePf8opqpRU/Tg2fHeJn2/V/yuk669Vpuv6/50o/c 6zesXzS99O4/iRl+qQe2FTS+qrbvVv1e+SrV9OPm5gQFI6lJH5m9NerO/VViKc5INNRiLipO BAA5bNuV9AIAAA== Archived-At: Subject: Re: [kitten] New SPAKE Preauthentication Draft X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 05:03:45 -0000 On Mon, Dec 12, 2016 at 05:50:28PM -0500, Nathaniel McCallum wrote: > https://datatracker.ietf.org/doc/draft-mccallum-kitten-krb-spake-preauth/ > > There have been many updates to the draft over the last year. I > believe this latest draft has incorporated all of the previous > suggestions. We have made many other improvements as well. Work has > begun implementing this draft in the MIT codebase. As a reminder, the chairs would like to be able to have the working group take on exciting new work like this (which seems to be a strong candidate for adoption once adoption is opened up), but we would really like to advance another document to the IESG before adopting additional WG documents. Right now the best way interested parties could help would be to review draft-ietf-kitten-rfc5653bis -- one more positive review should be enough for us to be willing to declare WG consensus. Thanks to all who have already reviewed that document and others! -Ben From nobody Thu Dec 15 14:33:55 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3632C129590; Thu, 15 Dec 2016 14:33:53 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.40.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148184123321.24681.4156270030170690818.idtracker@ietfa.amsl.com> Date: Thu, 15 Dec 2016 14:33:53 -0800 Archived-At: Cc: kitten@ietf.org Subject: [kitten] I-D Action: draft-ietf-kitten-krb-auth-indicator-04.txt X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 22:33:53 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Common Authentication Technology Next Generation of the IETF. Title : Authentication Indicator in Kerberos Tickets Authors : Anupam Jain Nathan Kinder Nathaniel McCallum Filename : draft-ietf-kitten-krb-auth-indicator-04.txt Pages : 5 Date : 2016-12-15 Abstract: This document updates RFC 4120 in order to specify an extension in the Kerberos protocol. It defines a new authorization data type AD- AUTHENTICATION-INDICATOR. The purpose of introducing this data type is to include an indicator of the strength of a client's authentication in service tickets so that application services can use it as an input into policy decisions. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-kitten-krb-auth-indicator/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-kitten-krb-auth-indicator-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-kitten-krb-auth-indicator-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Dec 15 18:36:30 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B3891294C2 for ; Thu, 15 Dec 2016 18:36:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.097 X-Spam-Level: X-Spam-Status: No, score=-7.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e8piJJmjFvNk for ; Thu, 15 Dec 2016 18:36:26 -0800 (PST) Received: from dmz-mailsec-scanner-8.mit.edu (dmz-mailsec-scanner-8.mit.edu [18.7.68.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAD58129489 for ; Thu, 15 Dec 2016 18:36:25 -0800 (PST) X-AuditID: 12074425-483ff70000003d2e-a4-585353289d83 Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 37.2F.15662.82353585; Thu, 15 Dec 2016 21:36:24 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-1.mit.edu (8.13.8/8.9.2) with ESMTP id uBG2aNK6032100 for ; Thu, 15 Dec 2016 21:36:24 -0500 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id uBG2aK9d002959 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 15 Dec 2016 21:36:23 -0500 Date: Thu, 15 Dec 2016 20:36:20 -0600 From: Benjamin Kaduk To: kitten@ietf.org Message-ID: <20161216023620.GQ8460@kduck.kaduk.org> References: <148184123321.24681.4156270030170690818.idtracker@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <148184123321.24681.4156270030170690818.idtracker@ietfa.amsl.com> User-Agent: Mutt/1.6.1 (2016-04-27) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrKIsWRmVeSWpSXmKPExsUixCmqrKsRHBxhsHW3ucXRzatYHBg9liz5 yRTAGMVlk5Kak1mWWqRvl8CVcbp5NUvBYv6K1/MWsjcwPuLuYuTkkBAwkfh/fBtbFyMXh5BA G5PElY2HWCCc44wSJ87fZIJwXjNJnH3TzQzSwiKgKjHj5D8wm01ARaKh+zKYLSIgLLF76zsw W1jAV+LsxEZ2EJtXwFji5MyXYHEhoPi1J1Oh4oJA8ScsIDazgJbEjX8vgZZxANnSEsv/cYCE OQX8JB4+6wErERVQlmiY8YB5AiP/LCTds5B0z0LoXsDIvIpRNiW3Sjc3MTOnODVZtzg5MS8v tUjXQi83s0QvNaV0EyMo9NhdVHcwzvnrdYhRgINRiYd3wZagCCHWxLLiytxDjJIcTEqivAYe wRFCfEn5KZUZicUZ8UWlOanFhxglOJiVRHinBQDleFMSK6tSi/JhUtIcLErivJcy3SOEBNIT S1KzU1MLUotgsjIcHEoSvIlBQI2CRanpqRVpmTklCGkmDk6Q4TxAw0+CDS8uSMwtzkyHyJ9i VJQS5+0LBEoIgCQySvPgekGpQSJ7f80rRnGgV4R5j4FU8QDTClz3K6DBTECDRZf4gwwuSURI STUwroj6M/Wi2g2H1qv/Ov/8e7Lo/7HZH9rqKsSWPBad+eCTWcjiGelNXnwcGtuZvur2HXrn YnRFZuv0rErWudv2564JfZ73erlWHIvB4jc/TNSnzNnZk+fq9VxTzpbXdMF7jlmP7t0+8f3E 9Mi9cwNmHrt4O1/n4pe5eRs9PE7pNZlP+fJ/fal3f4cSS3FGoqEWc1FxIgCqO91W6AIAAA== Archived-At: Subject: Re: [kitten] I-D Action: draft-ietf-kitten-krb-auth-indicator-04.txt X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Dec 2016 02:36:28 -0000 This just had a couple tweaks from the idnits script and shepherd review; it's been sent onward to the IESG for processing. -Ben On Thu, Dec 15, 2016 at 02:33:53PM -0800, internet-drafts@ietf.org wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the Common Authentication Technology Next Generation of the IETF. > > Title : Authentication Indicator in Kerberos Tickets > Authors : Anupam Jain > Nathan Kinder > Nathaniel McCallum > Filename : draft-ietf-kitten-krb-auth-indicator-04.txt > Pages : 5 > Date : 2016-12-15 > > Abstract: > This document updates RFC 4120 in order to specify an extension in > the Kerberos protocol. It defines a new authorization data type AD- > AUTHENTICATION-INDICATOR. The purpose of introducing this data type > is to include an indicator of the strength of a client's > authentication in service tickets so that application services can > use it as an input into policy decisions. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-kitten-krb-auth-indicator/ > > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-kitten-krb-auth-indicator-04 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-kitten-krb-auth-indicator-04 > > > Please note that it may take a couple of minutes from the time of submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > Kitten mailing list > Kitten@ietf.org > https://www.ietf.org/mailman/listinfo/kitten From nobody Fri Dec 16 09:47:55 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B58C129B2A for ; Fri, 16 Dec 2016 09:47:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.197 X-Spam-Level: X-Spam-Status: No, score=-7.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3T9LmAwhSRVM for ; Fri, 16 Dec 2016 09:47:51 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 027DB129B20 for ; Fri, 16 Dec 2016 09:47:50 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 2CD76BE53 for ; Fri, 16 Dec 2016 17:47:48 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ir2FKTCK_Jjk for ; Fri, 16 Dec 2016 17:47:46 +0000 (GMT) Received: from [10.87.48.210] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 93ACBBE3E for ; Fri, 16 Dec 2016 17:47:46 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1481910466; bh=AWW8x4bwd7aGoRKl2rjUuFs0Nx+9pLrIkAvbWXQ7fyM=; h=Subject:References:To:From:Date:In-Reply-To:From; b=MzCUQhJF3Rnuv0zIF9yGpjoxl+EQ+vzNnCIJzvJrfNTIUQTy5HOKoOgeZiv5BLxm7 QJWCOeZHfvz8O58rATqJe31MsDOfaJ5+jB86WOdo5HB3O8jCRS7SVJNMbODdhtHNDw U++MjFKu8jy6LgaRO816tnkAh+RQGrWe0mdT22+g= References: <148191033495.14788.14460275142775225346.idtracker@ietfa.amsl.com> To: "kitten@ietf.org" From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= X-Forwarded-Message-Id: <148191033495.14788.14460275142775225346.idtracker@ietfa.amsl.com> Message-ID: <2ae88934-3f43-1f61-853d-7a00db402a0e@cs.tcd.ie> Date: Fri, 16 Dec 2016 17:47:46 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: <148191033495.14788.14460275142775225346.idtracker@ietfa.amsl.com> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms090407040700000907040705" Archived-At: Subject: [kitten] Fwd: Last Call: X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Dec 2016 17:47:53 -0000 This is a cryptographically signed message in MIME format. --------------ms090407040700000907040705 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable FYI, I've requested IETF last call for this. The only comment I had on the content is that it might have been nice to add some example values that folks have been using in the real world, if there any such values that we can use. Otherwise, this is nicely crisp and clear, Thanks, S. -------- Forwarded Message -------- Subject: Last Call: Date: Fri, 16 Dec 2016 09:45:34 -0800 From: DraftTracker Mail System To: iesg-secretary@ietf.org CC: kaduk@mit.edu, Benjamin Kaduk , stephen.farrell@cs.tcd= =2Eie Last Call Request has been submitted for https://datatracker.ietf.org/doc/draft-ietf-kitten-krb-auth-indicator/ --------------ms090407040700000907040705 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjEyMTYx NzQ3NDZaMC8GCSqGSIb3DQEJBDEiBCCKLRMu6ELcj31XELaM0FMOeEtlYJz9yWArAyODu57x QDBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQAN7tqqRW3Jp5wqYlhpnx9y7vUL9QXm/BclCD2P8/J5PdduDG5BI541 1/VmZxWFRLXKnrDNeM/IuuGhIaEjPe+xrtOfzpsDWBH/q2A5d33lYhHF+dOlhBghpV0eHCra GAhtkWbjH6qJP5yxdYfydcXGVK6PjGuAea63BEMRSM9ih8CfzMr2tVPOUBKAtCA2esdy8HP2 JyfV95CxD2t4VscqsxTZ3GFCvKNED32N1810/0Xxnoj2d3mvl1Xo6swLgKbGGKRj3yyoxUSY Al/3a1YvUTKDaXtxnEZ41NdzK/Z18Vsn9bhnDCXKsfskYd591dM3EPXXvSxPvBVePLVwEcds AAAAAAAA --------------ms090407040700000907040705-- From nobody Fri Dec 16 09:57:56 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 65A9F129408; Fri, 16 Dec 2016 09:57:52 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.40.1 Auto-Submitted: auto-generated Precedence: bulk Sender: Message-ID: <148191107239.14649.9630483928383019146.idtracker@ietfa.amsl.com> Date: Fri, 16 Dec 2016 09:57:52 -0800 Archived-At: Cc: kitten@ietf.org, kitten-chairs@ietf.org, draft-ietf-kitten-krb-auth-indicator@ietf.org Subject: [kitten] Last Call: (Authentication Indicator in Kerberos Tickets) to Proposed Standard X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Reply-To: ietf@ietf.org List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Dec 2016 17:57:52 -0000 The IESG has received a request from the Common Authentication Technology Next Generation WG (kitten) to consider the following document: - 'Authentication Indicator in Kerberos Tickets' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2017-01-06. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This document updates RFC 4120 in order to specify an extension in the Kerberos protocol. It defines a new authorization data type AD- AUTHENTICATION-INDICATOR. The purpose of introducing this data type is to include an indicator of the strength of a client's authentication in service tickets so that application services can use it as an input into policy decisions. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-kitten-krb-auth-indicator/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-kitten-krb-auth-indicator/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Fri Dec 16 10:08:54 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADE6C1296A8 for ; Fri, 16 Dec 2016 10:08:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.403 X-Spam-Level: X-Spam-Status: No, score=-0.403 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_FROM=0.999, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1DBZ2rPIx4rT for ; Fri, 16 Dec 2016 10:08:51 -0800 (PST) Received: from mail-io0-f170.google.com (mail-io0-f170.google.com [209.85.223.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFEFD129A65 for ; Fri, 16 Dec 2016 10:08:50 -0800 (PST) Received: by mail-io0-f170.google.com with SMTP id p42so104083606ioo.1 for ; Fri, 16 Dec 2016 10:08:50 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=JmAd5slXRSbbNabefrSHo4OCZUU/3eIw0gKRalnCN3U=; b=sq3FeOuallecq9Krr4r/Lr0XJKz03hpiCWroMebyaQ93QQkYK24tMqJJuqlVQMgkfX 4WNq2+5wuQlqbqHbGJ79840TmxGXkToelPCbpCQMATjDRFr2wwrpfwJ9+zItRBXG5YM/ cJp8jMj2amehwi1N+MH39+0mUPujn8mHEmqo8LTu3G7Gm4V1sczD+GxS+xWMllQrohDF YZ2cBGlGDjCvb44/gSDGSmJA2WsVVR7NrYQtTD+cK9aNgF3TCHg8YgWyKqlpwcYTtnYk RGYWgKCQPYMrIM1SvyN7VMG2i8bfms1JTfU6p82COvTuha1Hiii5eKHDNvO8gqsbnDtk yEWg== X-Gm-Message-State: AIkVDXLVVL0F7HBSaMOgzZkreTL1sw3XFyIA8nkk/1l0gD8ef72q8z5v5WPzo02EyDJVcXSoofKf3H6J2UhnhtX6 X-Received: by 10.107.153.134 with SMTP id b128mr4564789ioe.160.1481911730233; Fri, 16 Dec 2016 10:08:50 -0800 (PST) MIME-Version: 1.0 Received: by 10.107.28.68 with HTTP; Fri, 16 Dec 2016 10:08:49 -0800 (PST) In-Reply-To: <2ae88934-3f43-1f61-853d-7a00db402a0e@cs.tcd.ie> References: <148191033495.14788.14460275142775225346.idtracker@ietfa.amsl.com> <2ae88934-3f43-1f61-853d-7a00db402a0e@cs.tcd.ie> From: Nathaniel McCallum Date: Fri, 16 Dec 2016 13:08:49 -0500 Message-ID: To: Stephen Farrell Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "kitten@ietf.org" Subject: Re: [kitten] Fwd: Last Call: X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Dec 2016 18:08:52 -0000 The only pre-defined values we could realistically give as an example are those in the LOA registry: https://www.iana.org/assignments/loa-profiles/loa-profiles.xhtml. However, these values can be seen just by looking at the registry itself. The RFC which creates the registry is an informative reference and is mentioned explicitly by the document. All other values are site-defined. We can add examples to the draft if needed. However, I think looking at the LOA registry itself is more valuable. On Fri, Dec 16, 2016 at 12:47 PM, Stephen Farrell wrote: > > FYI, I've requested IETF last call for this. > > The only comment I had on the content is that it might have > been nice to add some example values that folks have been > using in the real world, if there any such values that we > can use. > > Otherwise, this is nicely crisp and clear, > Thanks, > S. > > > -------- Forwarded Message -------- > Subject: Last Call: > Date: Fri, 16 Dec 2016 09:45:34 -0800 > From: DraftTracker Mail System > To: iesg-secretary@ietf.org > CC: kaduk@mit.edu, Benjamin Kaduk , stephen.farrell@cs.tcd.ie > > > Last Call Request has been submitted for > > > https://datatracker.ietf.org/doc/draft-ietf-kitten-krb-auth-indicator/ > > > _______________________________________________ > Kitten mailing list > Kitten@ietf.org > https://www.ietf.org/mailman/listinfo/kitten > From nobody Fri Dec 16 11:33:03 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A393412953E for ; Fri, 16 Dec 2016 11:33:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.022 X-Spam-Level: X-Spam-Status: No, score=-2.022 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gGn3YIbXI2Aa for ; Fri, 16 Dec 2016 11:33:00 -0800 (PST) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0099.outbound.protection.outlook.com [104.47.34.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 970B1129440 for ; Fri, 16 Dec 2016 11:33:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=CuRccGFR8h2dYiYSp78DDJ3xBo5Xz+SmFkp598rSHxk=; b=BR6RR9Z6bXbDrTMu5bIXzlb8ZaQFz+CQa1gqshs3K5BupXSUMq3zKfSCkFbyIe5icqbYuhn8vYtJxM8ouuXUJYY7AmyLN7sFAhidDDBXtmUslhAwlfmoLqpcDC1QIguGONdWjqDLkQOE/FJrOODVUlhiDzdQboyuLNKtwyMcdjU= Received: from CY1PR03MB2315.namprd03.prod.outlook.com (10.166.207.138) by CY1PR03MB2314.namprd03.prod.outlook.com (10.166.207.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.771.8; Fri, 16 Dec 2016 19:32:59 +0000 Received: from CY1PR03MB2315.namprd03.prod.outlook.com ([10.166.207.138]) by CY1PR03MB2315.namprd03.prod.outlook.com ([10.166.207.138]) with mapi id 15.01.0771.014; Fri, 16 Dec 2016 19:32:59 +0000 From: Michiko Short To: "Henry B (Hank) Hotz, CISSP" , Greg Hudson Thread-Topic: [kitten] Freshness Security Considerations for minimum/maximum size Thread-Index: AdJL+WK9inTSuXD+SZmasY5nwhJ7MAAEkkwAAALX7IAC7v4nAA== Date: Fri, 16 Dec 2016 19:32:59 +0000 Message-ID: References: <3cee1ab5-8f73-fce0-58a8-36a1697c9b77@mit.edu> <0ABB5934-C7E7-4DBD-B21A-3986B4DB6440@oxy.edu> In-Reply-To: <0ABB5934-C7E7-4DBD-B21A-3986B4DB6440@oxy.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=michikos@microsoft.com; x-originating-ip: [2001:4898:80e8:6::681] x-ms-office365-filtering-correlation-id: 80005169-4227-46cb-ad6d-08d425ea57e0 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:CY1PR03MB2314; x-microsoft-exchange-diagnostics: 1; CY1PR03MB2314; 7:EM/ZCGc0JhzDvjf6ODauIEjGcJjA6p9eLN2GvfT+lxsrWFbXtSAeN/h/RQegtvnYrM7sUZdTu1EYCliXmVi5GJODa74lluTW65BDylzCIIZlyWTwzcRrHKxQZNthw7i+sr8n3LfXG0euSi6lCcQ9tmjAe5nFIVo/dK0YE0XW0AL+PjIu1ebIB4vMzn+pZiqSpB7kbj4du0OZpjlMX5QNrF+dDgER4zKKSjvDb7WHRffi/67HCPc+IVkFFA9xExSedyHvbdKLMDmH+tgUMISjvnzkhWUcA1U0s5WsyL9457/FI56zFoO6p/EmYrlmE3qLAnE89pJCxZ7wUqldXtWzxf6nPQ2OQrQn+/aJ+XloLfQHGM/RcT/A3GahIe5krpGMxKrCpwmVXwxA91Zdn3sxcf75lLhTdwib5Zmf6LMZAqEWG2HXTQ8PnyVcsH/BbORcbcruaLhaTa3QxwigJMstKDAzsxCSDr1EtEeg+ElxUvI= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123558021)(20161123560025)(20161123562025)(20161123555025)(6047074)(6072148); SRVR:CY1PR03MB2314; BCL:0; PCL:0; RULEID:; SRVR:CY1PR03MB2314; x-forefront-prvs: 01583E185C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39450400003)(39840400002)(39410400002)(39860400002)(39850400002)(199003)(189002)(377454003)(13464003)(24454002)(5660300001)(2900100001)(122556002)(5001770100001)(54356999)(99286002)(9686002)(105586002)(5005710100001)(101416001)(106356001)(10090500001)(33656002)(50986999)(6116002)(102836003)(25786008)(97736004)(189998001)(74316002)(76176999)(7696004)(10290500002)(68736007)(92566002)(4326007)(305945005)(15650500001)(2906002)(77096006)(81166006)(38730400001)(6436002)(8676002)(81156014)(76576001)(7736002)(8936002)(3660700001)(2950100002)(86612001)(86362001)(6506006)(8990500004)(229853002)(2171001)(3280700002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR03MB2314; H:CY1PR03MB2315.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Dec 2016 19:32:59.0928 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR03MB2314 Archived-At: Cc: "kitten@ietf.org" Subject: Re: [kitten] Freshness Security Considerations for minimum/maximum size X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Dec 2016 19:33:02 -0000 VGhhdCBjb3VsZCB3b3JrIG9uIHRoZSBLREMgc2lkZS4gVGhlIGNsaWVudCBjYW5ub3QuIEl0IGRv ZXMgbm90IGtub3cgd2hhdCBpcyBpbiB0aGUgdG9rZW4gb3IgZXZlbiBoYXZlIHN1cHBvcnQgZm9y IHRoZSBldHlwZSB0aGF0IHByb3RlY3RzIGl0Lg0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0t LQ0KRnJvbTogSGVucnkgQiAoSGFuaykgSG90eiwgQ0lTU1AgW21haWx0bzpoYmhvdHpAb3h5LmVk dV0gDQpTZW50OiBUaHVyc2RheSwgRGVjZW1iZXIgMSwgMjAxNiAxOjA4IFBNDQpUbzogR3JlZyBI dWRzb24gPGdodWRzb25AbWl0LmVkdT4NCkNjOiBNaWNoaWtvIFNob3J0IDxtaWNoaWtvc0BtaWNy b3NvZnQuY29tPjsga2l0dGVuQGlldGYub3JnDQpTdWJqZWN0OiBSZTogW2tpdHRlbl0gRnJlc2hu ZXNzIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIGZvciBtaW5pbXVtL21heGltdW0gc2l6ZQ0KDQpN aWxkbHkgZGlzYWdyZWUuIFRoZSBwb2ludCBpcyB0byBhdm9pZCBwcm9jZXNzaW5nIGJvZ3VzIG1l c3NhZ2VzLiBJ4oCZZCBzdWdnZXN0IGEgc2VjdXJpdHkgY29uc2lkZXJhdGlvbiBub3RpbmcgdGhp cyBpc3N1ZSBhbmQgcmVjb21tZW5kaW5nIHRoYXQgYW55dGhpbmcgdG9vIGJpZyB0byBtYXRjaCBh bnkgc3VwcG9ydGVkIGVuY3J5cHRpb24gdHlwZSBzaG91bGQgYmUgc3VtbWFyaWx5IHRocm93biBh d2F5Lg0KDQo+IE9uIERlYyAxLCAyMDE2LCBhdCAxMTo0NiBBTSwgR3JlZyBIdWRzb24gPGdodWRz b25AbWl0LmVkdT4gd3JvdGU6DQo+IA0KPj4gTWF4aW11bSBsZW5ndGgNCj4gDQo+IFNheWluZyBh bnl0aGluZyBhYm91dCBtYXhpbXVtIGxlbmd0aHMgd291bGQgYmUgb3V0IG9mIGNoYXJhY3RlciBm b3IgDQo+IEtlcmJlcm9zIHN0YW5kYXJkcywgSSB0aGluay4gIEkgZG9uJ3QgdGhpbmsgd2Ugc2hv dWxkIHNwZWNpZnkgYSANCj4gbWF4aW11bSBsZW5ndGguDQoNClBlcnNvbmFsIGVtYWlsLiAgaGJo b3R6QG94eS5lZHUNCg0KDQoNCg== From nobody Tue Dec 20 08:59:13 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A4D3129B91; Tue, 20 Dec 2016 08:59:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.401 X-Spam-Level: X-Spam-Status: No, score=-7.401 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id THISo6ZNeotX; Tue, 20 Dec 2016 08:59:04 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE8E0129B90; Tue, 20 Dec 2016 08:59:03 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 176EEBE4D; Tue, 20 Dec 2016 16:59:00 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nbp8qNtCa6-j; Tue, 20 Dec 2016 16:58:58 +0000 (GMT) Received: from [10.87.48.210] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 0E6E1BE2F; Tue, 20 Dec 2016 16:58:58 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1482253138; bh=Tph83LANXE9iSJEt5RL3QsYoOEUHSi0mN7tmMigo1D8=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=sNXoFZr9llC/fYar5VzAVk01GS6lR/piEcCQKiceTV0pB+L4CwT/sEAmI+321bKrX ajG2j6OiUC0HZGJ9Ksy27D0YCTqmL4Nzpn4/OTOERGuj7WdqvC//t3iiI9M5n3u1CR oGOpoTbZo77FqKRmP0Nl96vdudTjsjU45c9WB79M= To: Kathleen Moriarty , The IESG References: <148047251432.11670.13523989384092580597.idtracker@ietfa.amsl.com> From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: Date: Tue, 20 Dec 2016 16:58:58 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: <148047251432.11670.13523989384092580597.idtracker@ietfa.amsl.com> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms090402080103060408080400" Archived-At: Cc: mrogers@redhat.com, kitten@ietf.org, kitten-chairs@ietf.org, draft-ietf-kitten-pkinit-freshness@ietf.org Subject: Re: [kitten] Kathleen Moriarty's Discuss on draft-ietf-kitten-pkinit-freshness-07: (with DISCUSS) X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 16:59:07 -0000 This is a cryptographically signed message in MIME format. --------------ms090402080103060408080400 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Kathleen, Kitten-WG: I read the thread on this and I think a suggestion made on the kitten list [1] by Greg Hudson ought work to address the valid concern that a too-short or predictable freshness token could be abused. The suggestion was to add a new paragraph to the security considerations saying: "If freshness tokens sent by the KDC are too short or too predictable, an attacker may be able to defeat the mechanism by creating signatures using every possible token value. To prevent this attack, the freshness token SHOULD contain a minimum of 64 unpredictable bits." If that works, I can add an RFC editor note to that effect or the authors can fire out a new draft. Greg also said: "I am willing to accept an amendment changing 64 to 96 or 128. It's a SHOULD, so it doesn't really constrain the implementation." And I agree that any of those numbers would likely be fine. So: Kathleen - do you think that'd be sufficient to resolve your discuss? If not, what would work? (If the above is good enough to get the discuss cleared, then I'll ask for opinions from the WG as to whether there are any issues with it. But please hold off for now until we see if Kathleen is ok with this resolution.) Thanks, S. PS: Be nice to get this sorted before the holidays:-) [1] https://www.ietf.org/mail-archive/web/kitten/current/msg06199.html On 30/11/16 02:21, Kathleen Moriarty wrote: > Kathleen Moriarty has entered the following ballot position for > draft-ietf-kitten-pkinit-freshness-07: Discuss >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut this= > introductory paragraph, however.) >=20 >=20 > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.ht= ml > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > DISCUSS: > ---------------------------------------------------------------------- >=20 > Holding a discuss until the Gen-art conversation on minimum size of the= > fressness token resolves. Will switch to a yes once that is resolved. > https://www.ietf.org/mail-archive/web/gen-art/current/msg13942.html >=20 >=20 >=20 >=20 > _______________________________________________ > Kitten mailing list > Kitten@ietf.org > https://www.ietf.org/mailman/listinfo/kitten >=20 --------------ms090402080103060408080400 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjEyMjAx NjU4NThaMC8GCSqGSIb3DQEJBDEiBCDI6L51IN9n2f09AWPy6oCIhljPuQz6m3qRbBB9pCwZ nzBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQAgYYKceW0pGPwAqG+fGgEOWYBwECpXvQoSVMyW55UPf8kShiAd83W3 qL2EnaeyT0N9vhpoHlOkLxdAoFpcOfZsP3U2mddG8bPcJojjhU9zocQRY+TVFamo7I6s8Dkx VS4cEf+OricO+iZAVkyBui982JcisnraSj4Q4xlbimrTxwDDjiwI1tbmXWnpvoPyYkPpq7u1 qXTpx0H7GOCEcvNPzEh9/rG7LVVR2FFeT9LyheV8jiT3frXepyWTKkDWNS4/db8Aj+uD8Hqi U859O6pxveQw4bq0SGxgleviWCWB6HI+B6GFOuVoDXGzRAka0ZtIgvUW5Jq60Q5blyaEkEER AAAAAAAA --------------ms090402080103060408080400-- From nobody Tue Dec 20 11:43:38 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B85F129B21; Tue, 20 Dec 2016 11:43:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 93BmQMqT7xi9; Tue, 20 Dec 2016 11:43:30 -0800 (PST) Received: from mail-qt0-x22a.google.com (mail-qt0-x22a.google.com [IPv6:2607:f8b0:400d:c0d::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F258129C25; Tue, 20 Dec 2016 11:43:24 -0800 (PST) Received: by mail-qt0-x22a.google.com with SMTP id n6so186976361qtd.1; Tue, 20 Dec 2016 11:43:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=vZAmTprgL9wDMxQAT8Gs7WvdS4jKyu4Lt7GHULYyJS4=; b=U3M7pVPAhBm6q51hrb+9rt7aqa0RT6bvREjVgv85hv8RRttKYuj57e0b8pPcMJFklC ozK/EadJLNzCvbbZouugauk2BwPl6flzpCUNA9Od5WhQ5LccCCTZrjfpYzTLljhL2unI x0JHJMgBPeDEiy3Qz1kA2QZ/bKl7nbaDC+lapL7p3UmYZSdIGYDwZQvw25nWh9+AyOxB 8hmy/gMdx5tl54xwJWgZGiLLqq7MX6xtZPBPjlXe/JI5b7zfSaD6rTP796zodsdc83pW ceBd658e3V5OXtHYDqbFw7HmtiMJJW9ymUoyLouAS4xVVEannhJiIPxI/QdGHsyQ0vXy dHIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=vZAmTprgL9wDMxQAT8Gs7WvdS4jKyu4Lt7GHULYyJS4=; b=MKOOKosViaBVf2g6zzFuOXC7RE3LcqIBcmk9bi2Kpbzz7HGvNSXFAjxUOU+v7i4VfG ekexJa8cHGsFVF9rjcd02VQ+bZMej/69+P44/SQQNHqpaO6e9kepu0qQDNPmPSFi9yGZ yil7DQm2r0uCdAmIt3UEyY7GRdw52L1oDQvu4DQWLPLb9CH5e7b6a4d8GZJ8ibobiiUi q6bhsxm2UQ09bbQTRdIbkLD+b2Q2UW8KHk5Fi9mpY4KRRsxwK0LY0sYIfVTD4eYOx21z NCwkeu7IZRbP2JGgWWRAqTQ8w6eN8nZq3JgBBGeklO5trju5E1MCSPqr3IP03uEBSwYu BkmQ== X-Gm-Message-State: AIkVDXLB7roD0dutxAZdM7kkk/9hHUAAyFdKcgim3yC+FyQw2PpbjC/050GY6AZBjzFqzZk8q5m0bHPX19ycOQ== X-Received: by 10.200.43.166 with SMTP id m35mr1146760qtm.261.1482263003721; Tue, 20 Dec 2016 11:43:23 -0800 (PST) MIME-Version: 1.0 Received: by 10.12.161.101 with HTTP; Tue, 20 Dec 2016 11:43:23 -0800 (PST) In-Reply-To: References: <148047251432.11670.13523989384092580597.idtracker@ietfa.amsl.com> From: Kathleen Moriarty Date: Tue, 20 Dec 2016 14:43:23 -0500 Message-ID: To: Stephen Farrell Content-Type: multipart/alternative; boundary=001a1145ecfccd022905441c3f32 Archived-At: Cc: mrogers@redhat.com, kitten@ietf.org, kitten-chairs@ietf.org, The IESG , draft-ietf-kitten-pkinit-freshness@ietf.org Subject: Re: [kitten] Kathleen Moriarty's Discuss on draft-ietf-kitten-pkinit-freshness-07: (with DISCUSS) X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 19:43:32 -0000 --001a1145ecfccd022905441c3f32 Content-Type: text/plain; charset=UTF-8 Hi Stephen, Thanks for digging into this. Inline. On Tue, Dec 20, 2016 at 11:58 AM, Stephen Farrell wrote: > > Hi Kathleen, Kitten-WG: > > I read the thread on this and I think a suggestion made > on the kitten list [1] by Greg Hudson ought work to > address the valid concern that a too-short or predictable > freshness token could be abused. > > The suggestion was to add a new paragraph to the security > considerations saying: > > "If freshness tokens sent by the KDC are too short or too > predictable, an attacker may be able to defeat the mechanism > by creating signatures using every possible token value. > To prevent this attack, the freshness token SHOULD contain > a minimum of 64 unpredictable bits." > > Yes, that works for me, thanks. > If that works, I can add an RFC editor note to that effect > or the authors can fire out a new draft. > > Greg also said: "I am willing to accept an amendment changing > 64 to 96 or 128. It's a SHOULD, so it doesn't really constrain > the implementation." And I agree that any of those numbers > would likely be fine. > > So: > > Kathleen - do you think that'd be sufficient to resolve your > discuss? If not, what would work? > > (If the above is good enough to get the discuss cleared, then > I'll ask for opinions from the WG as to whether there are any > issues with it. But please hold off for now until we see if > Kathleen is ok with this resolution.) > > Please let me know if the WG agrees or next steps. Thank you, Kathleen > Thanks, > S. > > PS: Be nice to get this sorted before the holidays:-) > > [1] https://www.ietf.org/mail-archive/web/kitten/current/msg06199.html > > On 30/11/16 02:21, Kathleen Moriarty wrote: > > Kathleen Moriarty has entered the following ballot position for > > draft-ietf-kitten-pkinit-freshness-07: Discuss > > > > When responding, please keep the subject line intact and reply to all > > email addresses included in the To and CC lines. (Feel free to cut this > > introductory paragraph, however.) > > > > > > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria. > html > > for more information about IESG DISCUSS and COMMENT positions. > > > > > > The document, along with other ballot positions, can be found here: > > https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/ > > > > > > > > ---------------------------------------------------------------------- > > DISCUSS: > > ---------------------------------------------------------------------- > > > > Holding a discuss until the Gen-art conversation on minimum size of the > > fressness token resolves. Will switch to a yes once that is resolved. > > https://www.ietf.org/mail-archive/web/gen-art/current/msg13942.html > > > > > > > > > > _______________________________________________ > > Kitten mailing list > > Kitten@ietf.org > > https://www.ietf.org/mailman/listinfo/kitten > > > > -- Best regards, Kathleen --001a1145ecfccd022905441c3f32 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi Stephen,=C2=A0

Thanks for digging in= to this.=C2=A0 Inline.

On Tue, Dec 20, 2016 at 11:58 AM, Stephen Farrell <step= hen.farrell@cs.tcd.ie> wrote:

Hi Kathleen, Kitten-WG:

I read the thread on this and I think a suggestion made
on the kitten list [1] by Greg Hudson ought work to
address the valid concern that a too-short or predictable
freshness token could be abused.

The suggestion was to add a new paragraph to the security
considerations saying:

"If freshness tokens sent by the KDC are too short or too
predictable, an attacker may be able to defeat the mechanism
by creating signatures using every possible token value.
To prevent this attack, the freshness token SHOULD contain
a minimum of 64 unpredictable bits."


Yes, that works for me, thanks.
<= div>=C2=A0
If that works, I can add an RFC editor note to that effect
or the authors can fire out a new draft.

Greg also said: "I am willing to accept an amendment changing
64 to 96 or 128.=C2=A0 It's a SHOULD, so it doesn't really constrai= n
the implementation." And I agree that any of those numbers
would likely be fine.

So:

Kathleen - do you think that'd be sufficient to resolve your
discuss? If not, what would work?

(If the above is good enough to get the discuss cleared, then
I'll ask for opinions from the WG as to whether there are any
issues with it. But please hold off for now until we see if
Kathleen is ok with this resolution.)


Please let me know if the WG agrees or= next steps.

Thank you,
Kathleen
=C2=A0
Thanks,
S.

PS: Be nice to get this sorted before the holidays:-)

[1] https://www.ietf.org/mail-archive/web/kitten/current/msg06199.html

On 30/11/16 02:21, Kathleen Moriarty wrote:
> Kathleen Moriarty has entered the following ballot position for
> draft-ietf-kitten-pkinit-freshness-07: Discuss
>
> When responding, please keep the subject line intact and reply to all<= br> > email addresses included in the To and CC lines. (Feel free to cut thi= s
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/i= esg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here: > https://datatracker.ietf.or= g/doc/draft-ietf-kitten-pkinit-freshness/
>
>
>
> ------------------------------------------------------------= ----------
> DISCUSS:
> ------------------------------------------------------------= ----------
>
> Holding a discuss until the Gen-art conversation on minimum size of th= e
> fressness token resolves.=C2=A0 Will switch to a yes once that is reso= lved.
> https://www.ietf.org/mail-archive/web/gen-art/current/msg13942.html
>
>
>
>
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten
>




--
Best regards,
Kathleen
--001a1145ecfccd022905441c3f32-- From nobody Tue Dec 20 12:18:43 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6654A1299CE; Tue, 20 Dec 2016 12:18:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.401 X-Spam-Level: X-Spam-Status: No, score=-7.401 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YWKC55GvY0Nt; Tue, 20 Dec 2016 12:18:34 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF1BC1295FD; Tue, 20 Dec 2016 12:18:33 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 374E1BE51; Tue, 20 Dec 2016 20:18:30 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gzA6a4YyBHyG; Tue, 20 Dec 2016 20:18:28 +0000 (GMT) Received: from [10.87.48.210] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 5C7AEBE50; Tue, 20 Dec 2016 20:18:28 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1482265108; bh=DxQ3LrplUBnIebwUgpAL7+kBjSiA5WYm7uHHsqodjXM=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=j3Do23C3G0bcyTbiNnkYAmqtj1kIBAxF4dXrKKWqqI8BQbS+7mFVCzm6QjofmKPN4 y8aFK+bWlQBWR50bz8jSWR0T4pe1gaP24WatLyBmSTDu23qGirRTOJbTsG2Gy7ixMq gNQx6/4ax3cDn+LadPEAPsM/BaQmUN8lQPUbE7Lg= To: Kathleen Moriarty References: <148047251432.11670.13523989384092580597.idtracker@ietfa.amsl.com> From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <5367e5de-0d2b-3d92-1ded-17551685f14e@cs.tcd.ie> Date: Tue, 20 Dec 2016 20:18:28 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms000006060905000402020805" Archived-At: Cc: mrogers@redhat.com, kitten@ietf.org, kitten-chairs@ietf.org, The IESG , draft-ietf-kitten-pkinit-freshness@ietf.org Subject: Re: [kitten] Kathleen Moriarty's Discuss on draft-ietf-kitten-pkinit-freshness-07: (with DISCUSS) X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 20:18:37 -0000 This is a cryptographically signed message in MIME format. --------------ms000006060905000402020805 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 20/12/16 19:43, Kathleen Moriarty wrote: > Hi Stephen, >=20 > Thanks for digging into this. Inline. >=20 > On Tue, Dec 20, 2016 at 11:58 AM, Stephen Farrell > wrote: >=20 >> >> Hi Kathleen, Kitten-WG: >> >> I read the thread on this and I think a suggestion made >> on the kitten list [1] by Greg Hudson ought work to >> address the valid concern that a too-short or predictable >> freshness token could be abused. >> >> The suggestion was to add a new paragraph to the security >> considerations saying: >> >> "If freshness tokens sent by the KDC are too short or too >> predictable, an attacker may be able to defeat the mechanism >> by creating signatures using every possible token value. >> To prevent this attack, the freshness token SHOULD contain >> a minimum of 64 unpredictable bits." >> >> > Yes, that works for me, thanks. >=20 Great. So are the authors/chairs/WG ok with adding that too? If nobody objects I'll add the RFC editor note tomorrow and we can go from there. (There'll still be plent of time for later objections if this is somehow a horrible thing, but I can't see how that'd be the case at all:-) All going well, Kathleen can clear her discuss then and we can give this one to the RFC editor as a very slightly early holiday present. Cheers, S. >=20 >> If that works, I can add an RFC editor note to that effect >> or the authors can fire out a new draft. >> >> Greg also said: "I am willing to accept an amendment changing >> 64 to 96 or 128. It's a SHOULD, so it doesn't really constrain >> the implementation." And I agree that any of those numbers >> would likely be fine. >> >> So: >> >> Kathleen - do you think that'd be sufficient to resolve your >> discuss? If not, what would work? >> >> (If the above is good enough to get the discuss cleared, then >> I'll ask for opinions from the WG as to whether there are any >> issues with it. But please hold off for now until we see if >> Kathleen is ok with this resolution.) >> >> > Please let me know if the WG agrees or next steps. >=20 > Thank you, > Kathleen >=20 >=20 >> Thanks, >> S. >> >> PS: Be nice to get this sorted before the holidays:-) >> >> [1] https://www.ietf.org/mail-archive/web/kitten/current/msg06199.html= >> >> On 30/11/16 02:21, Kathleen Moriarty wrote: >>> Kathleen Moriarty has entered the following ballot position for >>> draft-ietf-kitten-pkinit-freshness-07: Discuss >>> >>> When responding, please keep the subject line intact and reply to all= >>> email addresses included in the To and CC lines. (Feel free to cut th= is >>> introductory paragraph, however.) >>> >>> >>> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.= >> html >>> for more information about IESG DISCUSS and COMMENT positions. >>> >>> >>> The document, along with other ballot positions, can be found here: >>> https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/ >>> >>> >>> >>> ---------------------------------------------------------------------= - >>> DISCUSS: >>> ---------------------------------------------------------------------= - >>> >>> Holding a discuss until the Gen-art conversation on minimum size of t= he >>> fressness token resolves. Will switch to a yes once that is resolved= =2E >>> https://www.ietf.org/mail-archive/web/gen-art/current/msg13942.html >>> >>> >>> >>> >>> _______________________________________________ >>> Kitten mailing list >>> Kitten@ietf.org >>> https://www.ietf.org/mailman/listinfo/kitten >>> >> >> >=20 >=20 --------------ms000006060905000402020805 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjEyMjAy MDE4MjhaMC8GCSqGSIb3DQEJBDEiBCAxYttMmUfExdSH4gfJeO1CuElDuvcZUtT5i14gYFv8 bzBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQAIwKoLWyQ2FtHpak2Hwt1tqH4I3Q3Magz1HrlnY41x4czeCj1/pBiQ P/3Rw1IoCw7vG484Ruplxngd/UGCG8jmlpjJ+tYEMZwrjBp+9sKfl1/+CCjPs0brmai11Ebx N/5qSh0HzzGeHBqrDwWn9juhFJgB49BFz5DKX7dDKbolRrV0x1YcBiLZ9kZI+XBlIj8aXlsC A0uan29JaTxeuZvPSga1nhlpezu6/s832yw3NPwJzTzOohLnH6VEJ5HaFreYDTAyTKz3BRnC zVXHkWjk8M3mbnJLbuygcucZzTRaBeABJYkcIWGcWIvk+D2XnGUPC408YBQE3aZ567vxv1Dj AAAAAAAA --------------ms000006060905000402020805-- From nobody Tue Dec 20 12:33:31 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 067801295B1; Tue, 20 Dec 2016 12:33:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.022 X-Spam-Level: X-Spam-Status: No, score=-2.022 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7SElKOHelrv1; Tue, 20 Dec 2016 12:33:28 -0800 (PST) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0129.outbound.protection.outlook.com [104.47.37.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F87E12960C; Tue, 20 Dec 2016 12:33:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=VMkCZF+WcK9kGDY9wn2m2t0q6tXh0AqTMH2Fyg/pnzQ=; b=SofVIqKu7zFODKn9XFHADsubDoSaaiAvBAO9rLSuwaCc7B4WYwE9TeeCEssaKDQgE6YZiUGxjcZi34fo2v05v1rejASE4QsBqqywBKNxzjMuL4eE78MF87MqABE8rJ+DiXOpLRv0Vf8g+lqbBg9s/EtweRhvW+nWYoX+sWtbl8o= Received: from CY1PR03MB2315.namprd03.prod.outlook.com (10.166.207.138) by CY1PR03MB2313.namprd03.prod.outlook.com (10.166.207.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.803.11; Tue, 20 Dec 2016 20:33:27 +0000 Received: from CY1PR03MB2315.namprd03.prod.outlook.com ([10.166.207.138]) by CY1PR03MB2315.namprd03.prod.outlook.com ([10.166.207.138]) with mapi id 15.01.0803.010; Tue, 20 Dec 2016 20:33:27 +0000 From: Michiko Short To: Stephen Farrell , Kathleen Moriarty Thread-Topic: [kitten] Kathleen Moriarty's Discuss on draft-ietf-kitten-pkinit-freshness-07: (with DISCUSS) Thread-Index: AQHSSrCav4teqLbWGUyJhnQWwUm91aERL1QAgAAt8ICAAAnNAIAAA+eQ Date: Tue, 20 Dec 2016 20:33:26 +0000 Message-ID: References: <148047251432.11670.13523989384092580597.idtracker@ietfa.amsl.com> <5367e5de-0d2b-3d92-1ded-17551685f14e@cs.tcd.ie> In-Reply-To: <5367e5de-0d2b-3d92-1ded-17551685f14e@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=michikos@microsoft.com; x-originating-ip: [2001:4898:80e8:f::681] x-ms-office365-filtering-correlation-id: 6927ff09-e0f6-4140-721b-08d4291773d8 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:CY1PR03MB2313; x-microsoft-exchange-diagnostics: 1; CY1PR03MB2313; 7:+0iyL4Sk+J/kpcCuo6iOi+Og+WLVf52sb3kZc/SHV+pb5ptAypuoRpy3BjIusEk/oVRbzxGG81KxLmZ7lv1XQ2eReKZ+c17G57elZ5365x94kJP7s350CnJ61rYHZmKUFwHJUemfKIM3qplEku/L/CNu6W+GjCgUPx5V5HzP+pQaHutNRAZJrEcqRIqKvgcx+cXWLjHxi7TzlTiodFyhp1LM4YRdyVymkJBSB3hbcySNtPpk3LtJYujjk93nn+5smopy/+rF2A+PVai/iXjtPSDOTiusH1g0P4I0/Kjmz4hj+/kRSheAM01/N/U73wRBLhIWgbnOPJT5ttoKXol4vZTVqDZpL7mA/g4pC0OeRpyr+nU7ZGBw7cbJAyE8zz7RvvchQ/TBWeK7fU+FTvwlPBaIj1Govpz1pLxAXHMNsCp53hMgEyv0KSfgX7K4BoKA6xqvJ6gaIG+kvf1TPrQf4Z0pfg8EW/7oWFuVIx3ik7Q= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(32856632585715)(120809045254105)(192374486261705); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123564025)(20161123562025)(20161123555025)(6072148)(6047074); SRVR:CY1PR03MB2313; BCL:0; PCL:0; RULEID:; SRVR:CY1PR03MB2313; x-forefront-prvs: 0162ACCC24 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39410400002)(39850400002)(39840400002)(39450400003)(39860400002)(13464003)(24454002)(199003)(189002)(377454003)(86612001)(122556002)(86362001)(189998001)(50986999)(305945005)(7696004)(76176999)(5660300001)(54356999)(102836003)(6116002)(7736002)(101416001)(93886004)(74316002)(38730400001)(39060400001)(10290500002)(5005710100001)(8990500004)(2950100002)(229853002)(3280700002)(10090500001)(25786008)(6436002)(77096006)(6506006)(2900100001)(99286002)(2906002)(4326007)(92566002)(106116001)(106356001)(105586002)(3660700001)(230783001)(33656002)(68736007)(97736004)(9686002)(5001770100001)(8676002)(8936002)(76576001)(81166006)(81156014); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR03MB2313; H:CY1PR03MB2315.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Dec 2016 20:33:26.8332 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR03MB2313 Archived-At: Cc: "mrogers@redhat.com" , "kitten@ietf.org" , "kitten-chairs@ietf.org" , The IESG , "draft-ietf-kitten-pkinit-freshness@ietf.org" Subject: Re: [kitten] Kathleen Moriarty's Discuss on draft-ietf-kitten-pkinit-freshness-07: (with DISCUSS) X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 20:33:30 -0000 V29ya3MgZm9yIG1lLiBQbGVhc2UgcHJvY2VlZC4gDQotTWljaA0KDQotLS0tLU9yaWdpbmFsIE1l c3NhZ2UtLS0tLQ0KRnJvbTogU3RlcGhlbiBGYXJyZWxsIFttYWlsdG86c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZV0gDQpTZW50OiBUdWVzZGF5LCBEZWNlbWJlciAyMCwgMjAxNiAxMjoxOCBQTQ0K VG86IEthdGhsZWVuIE1vcmlhcnR5IDxrYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbT4N CkNjOiBtcm9nZXJzQHJlZGhhdC5jb207IGtpdHRlbkBpZXRmLm9yZzsga2l0dGVuLWNoYWlyc0Bp ZXRmLm9yZzsgVGhlIElFU0cgPGllc2dAaWV0Zi5vcmc+OyBkcmFmdC1pZXRmLWtpdHRlbi1wa2lu aXQtZnJlc2huZXNzQGlldGYub3JnDQpTdWJqZWN0OiBSZTogW2tpdHRlbl0gS2F0aGxlZW4gTW9y aWFydHkncyBEaXNjdXNzIG9uIGRyYWZ0LWlldGYta2l0dGVuLXBraW5pdC1mcmVzaG5lc3MtMDc6 ICh3aXRoIERJU0NVU1MpDQoNCg0KSGl5YSwNCg0KT24gMjAvMTIvMTYgMTk6NDMsIEthdGhsZWVu IE1vcmlhcnR5IHdyb3RlOg0KPiBIaSBTdGVwaGVuLA0KPiANCj4gVGhhbmtzIGZvciBkaWdnaW5n IGludG8gdGhpcy4gIElubGluZS4NCj4gDQo+IE9uIFR1ZSwgRGVjIDIwLCAyMDE2IGF0IDExOjU4 IEFNLCBTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW4uZmFycmVsbEBjcy50Y2QuaWUNCj4+IHdyb3Rl Og0KPiANCj4+DQo+PiBIaSBLYXRobGVlbiwgS2l0dGVuLVdHOg0KPj4NCj4+IEkgcmVhZCB0aGUg dGhyZWFkIG9uIHRoaXMgYW5kIEkgdGhpbmsgYSBzdWdnZXN0aW9uIG1hZGUNCj4+IG9uIHRoZSBr aXR0ZW4gbGlzdCBbMV0gYnkgR3JlZyBIdWRzb24gb3VnaHQgd29yayB0bw0KPj4gYWRkcmVzcyB0 aGUgdmFsaWQgY29uY2VybiB0aGF0IGEgdG9vLXNob3J0IG9yIHByZWRpY3RhYmxlDQo+PiBmcmVz aG5lc3MgdG9rZW4gY291bGQgYmUgYWJ1c2VkLg0KPj4NCj4+IFRoZSBzdWdnZXN0aW9uIHdhcyB0 byBhZGQgYSBuZXcgcGFyYWdyYXBoIHRvIHRoZSBzZWN1cml0eQ0KPj4gY29uc2lkZXJhdGlvbnMg c2F5aW5nOg0KPj4NCj4+ICJJZiBmcmVzaG5lc3MgdG9rZW5zIHNlbnQgYnkgdGhlIEtEQyBhcmUg dG9vIHNob3J0IG9yIHRvbw0KPj4gcHJlZGljdGFibGUsIGFuIGF0dGFja2VyIG1heSBiZSBhYmxl IHRvIGRlZmVhdCB0aGUgbWVjaGFuaXNtDQo+PiBieSBjcmVhdGluZyBzaWduYXR1cmVzIHVzaW5n IGV2ZXJ5IHBvc3NpYmxlIHRva2VuIHZhbHVlLg0KPj4gVG8gcHJldmVudCB0aGlzIGF0dGFjaywg dGhlIGZyZXNobmVzcyB0b2tlbiBTSE9VTEQgY29udGFpbg0KPj4gYSBtaW5pbXVtIG9mIDY0IHVu cHJlZGljdGFibGUgYml0cy4iDQo+Pg0KPj4NCj4gWWVzLCB0aGF0IHdvcmtzIGZvciBtZSwgdGhh bmtzLg0KPiANCg0KR3JlYXQuIFNvIGFyZSB0aGUgYXV0aG9ycy9jaGFpcnMvV0cgb2sgd2l0aCBh ZGRpbmcgdGhhdA0KdG9vPyBJZiBub2JvZHkgb2JqZWN0cyBJJ2xsIGFkZCB0aGUgUkZDIGVkaXRv ciBub3RlDQp0b21vcnJvdyBhbmQgd2UgY2FuIGdvIGZyb20gdGhlcmUuIChUaGVyZSdsbCBzdGls bCBiZQ0KcGxlbnQgb2YgdGltZSBmb3IgbGF0ZXIgb2JqZWN0aW9ucyBpZiB0aGlzIGlzIHNvbWVo b3cNCmEgaG9ycmlibGUgdGhpbmcsIGJ1dCBJIGNhbid0IHNlZSBob3cgdGhhdCdkIGJlIHRoZQ0K Y2FzZSBhdCBhbGw6LSkNCg0KQWxsIGdvaW5nIHdlbGwsIEthdGhsZWVuIGNhbiBjbGVhciBoZXIg ZGlzY3VzcyB0aGVuDQphbmQgd2UgY2FuIGdpdmUgdGhpcyBvbmUgdG8gdGhlIFJGQyBlZGl0b3Ig YXMgYSB2ZXJ5DQpzbGlnaHRseSBlYXJseSBob2xpZGF5IHByZXNlbnQuDQoNCkNoZWVycywNClMu DQoNCj4gDQo+PiBJZiB0aGF0IHdvcmtzLCBJIGNhbiBhZGQgYW4gUkZDIGVkaXRvciBub3RlIHRv IHRoYXQgZWZmZWN0DQo+PiBvciB0aGUgYXV0aG9ycyBjYW4gZmlyZSBvdXQgYSBuZXcgZHJhZnQu DQo+Pg0KPj4gR3JlZyBhbHNvIHNhaWQ6ICJJIGFtIHdpbGxpbmcgdG8gYWNjZXB0IGFuIGFtZW5k bWVudCBjaGFuZ2luZw0KPj4gNjQgdG8gOTYgb3IgMTI4LiAgSXQncyBhIFNIT1VMRCwgc28gaXQg ZG9lc24ndCByZWFsbHkgY29uc3RyYWluDQo+PiB0aGUgaW1wbGVtZW50YXRpb24uIiBBbmQgSSBh Z3JlZSB0aGF0IGFueSBvZiB0aG9zZSBudW1iZXJzDQo+PiB3b3VsZCBsaWtlbHkgYmUgZmluZS4N Cj4+DQo+PiBTbzoNCj4+DQo+PiBLYXRobGVlbiAtIGRvIHlvdSB0aGluayB0aGF0J2QgYmUgc3Vm ZmljaWVudCB0byByZXNvbHZlIHlvdXINCj4+IGRpc2N1c3M/IElmIG5vdCwgd2hhdCB3b3VsZCB3 b3JrPw0KPj4NCj4+IChJZiB0aGUgYWJvdmUgaXMgZ29vZCBlbm91Z2ggdG8gZ2V0IHRoZSBkaXNj dXNzIGNsZWFyZWQsIHRoZW4NCj4+IEknbGwgYXNrIGZvciBvcGluaW9ucyBmcm9tIHRoZSBXRyBh cyB0byB3aGV0aGVyIHRoZXJlIGFyZSBhbnkNCj4+IGlzc3VlcyB3aXRoIGl0LiBCdXQgcGxlYXNl IGhvbGQgb2ZmIGZvciBub3cgdW50aWwgd2Ugc2VlIGlmDQo+PiBLYXRobGVlbiBpcyBvayB3aXRo IHRoaXMgcmVzb2x1dGlvbi4pDQo+Pg0KPj4NCj4gUGxlYXNlIGxldCBtZSBrbm93IGlmIHRoZSBX RyBhZ3JlZXMgb3IgbmV4dCBzdGVwcy4NCj4gDQo+IFRoYW5rIHlvdSwNCj4gS2F0aGxlZW4NCj4g DQo+IA0KPj4gVGhhbmtzLA0KPj4gUy4NCj4+DQo+PiBQUzogQmUgbmljZSB0byBnZXQgdGhpcyBz b3J0ZWQgYmVmb3JlIHRoZSBob2xpZGF5czotKQ0KPj4NCj4+IFsxXSBodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsLWFyY2hpdmUvd2ViL2tpdHRlbi9jdXJyZW50L21zZzA2MTk5Lmh0bWwNCj4+DQo+ PiBPbiAzMC8xMS8xNiAwMjoyMSwgS2F0aGxlZW4gTW9yaWFydHkgd3JvdGU6DQo+Pj4gS2F0aGxl ZW4gTW9yaWFydHkgaGFzIGVudGVyZWQgdGhlIGZvbGxvd2luZyBiYWxsb3QgcG9zaXRpb24gZm9y DQo+Pj4gZHJhZnQtaWV0Zi1raXR0ZW4tcGtpbml0LWZyZXNobmVzcy0wNzogRGlzY3Vzcw0KPj4+ DQo+Pj4gV2hlbiByZXNwb25kaW5nLCBwbGVhc2Uga2VlcCB0aGUgc3ViamVjdCBsaW5lIGludGFj dCBhbmQgcmVwbHkgdG8gYWxsDQo+Pj4gZW1haWwgYWRkcmVzc2VzIGluY2x1ZGVkIGluIHRoZSBU byBhbmQgQ0MgbGluZXMuIChGZWVsIGZyZWUgdG8gY3V0IHRoaXMNCj4+PiBpbnRyb2R1Y3Rvcnkg cGFyYWdyYXBoLCBob3dldmVyLikNCj4+Pg0KPj4+DQo+Pj4gUGxlYXNlIHJlZmVyIHRvIGh0dHBz Oi8vd3d3LmlldGYub3JnL2llc2cvc3RhdGVtZW50L2Rpc2N1c3MtY3JpdGVyaWEuDQo+PiBodG1s DQo+Pj4gZm9yIG1vcmUgaW5mb3JtYXRpb24gYWJvdXQgSUVTRyBESVNDVVNTIGFuZCBDT01NRU5U IHBvc2l0aW9ucy4NCj4+Pg0KPj4+DQo+Pj4gVGhlIGRvY3VtZW50LCBhbG9uZyB3aXRoIG90aGVy IGJhbGxvdCBwb3NpdGlvbnMsIGNhbiBiZSBmb3VuZCBoZXJlOg0KPj4+IGh0dHBzOi8vZGF0YXRy YWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYta2l0dGVuLXBraW5pdC1mcmVzaG5lc3MvDQo+ Pj4NCj4+Pg0KPj4+DQo+Pj4gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KPj4+IERJU0NVU1M6DQo+Pj4gLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLQ0KPj4+DQo+Pj4gSG9sZGluZyBhIGRpc2N1c3MgdW50aWwgdGhlIEdlbi1hcnQgY29u dmVyc2F0aW9uIG9uIG1pbmltdW0gc2l6ZSBvZiB0aGUNCj4+PiBmcmVzc25lc3MgdG9rZW4gcmVz b2x2ZXMuICBXaWxsIHN3aXRjaCB0byBhIHllcyBvbmNlIHRoYXQgaXMgcmVzb2x2ZWQuDQo+Pj4g aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbC1hcmNoaXZlL3dlYi9nZW4tYXJ0L2N1cnJlbnQvbXNn MTM5NDIuaHRtbA0KPj4+DQo+Pj4NCj4+Pg0KPj4+DQo+Pj4gX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+PiBLaXR0ZW4gbWFpbGluZyBsaXN0DQo+Pj4g S2l0dGVuQGlldGYub3JnDQo+Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9raXR0ZW4NCj4+Pg0KPj4NCj4+DQo+IA0KPiANCg0K From nobody Tue Dec 20 13:26:50 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D938129631; Tue, 20 Dec 2016 13:26:49 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "Kathleen Moriarty" To: "The IESG" X-Test-IDTracker: no X-IETF-IDTracker: 6.40.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148226920916.23701.13275321658738455781.idtracker@ietfa.amsl.com> Date: Tue, 20 Dec 2016 13:26:49 -0800 Archived-At: Cc: mrogers@redhat.com, kitten@ietf.org, kitten-chairs@ietf.org, draft-ietf-kitten-pkinit-freshness@ietf.org Subject: [kitten] Kathleen Moriarty's No Objection on draft-ietf-kitten-pkinit-freshness-07: (with COMMENT) X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 21:26:49 -0000 Kathleen Moriarty has entered the following ballot position for draft-ietf-kitten-pkinit-freshness-07: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Thanks for covering my prior discuss with a paragraph provided as an RFC editor note. From nobody Tue Dec 20 13:37:02 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 829D5129642; Tue, 20 Dec 2016 13:36:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.401 X-Spam-Level: X-Spam-Status: No, score=-7.401 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k0SPvJ6xwL4n; Tue, 20 Dec 2016 13:36:56 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8E86129610; Tue, 20 Dec 2016 13:36:55 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 1B63BBE56; Tue, 20 Dec 2016 21:36:53 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KsDblyaMMKX4; Tue, 20 Dec 2016 21:36:50 +0000 (GMT) Received: from [10.87.48.210] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id B55F3BE53; Tue, 20 Dec 2016 21:36:49 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1482269810; bh=8kWrIr0+xTtpgv3lpwzFX7FUO72PuJ3iR8KR825gwt0=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=O/f1tMbbDL2k+DmR5XlPjEZ02FJDpw5R7xHfq3qUs9brTl+is9+sxtZEPRQShWLmb i8/SJL0e4jl1lkBpvHQWD3W3e9yjYpy7pA/N1UXdSBvSlunExVRIO7LCBd2IDUCi/6 UQbYJyzj58KtoQktGki1shR9u3baPkL3P2nstyb8= To: Kathleen Moriarty , The IESG References: <148226920916.23701.13275321658738455781.idtracker@ietfa.amsl.com> From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <742d5a24-dd76-beca-fe2b-4d3d00a0cd4a@cs.tcd.ie> Date: Tue, 20 Dec 2016 21:36:49 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: <148226920916.23701.13275321658738455781.idtracker@ietfa.amsl.com> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms070209020407000409070501" Archived-At: Cc: mrogers@redhat.com, kitten@ietf.org, kitten-chairs@ietf.org, draft-ietf-kitten-pkinit-freshness@ietf.org Subject: Re: [kitten] Kathleen Moriarty's No Objection on draft-ietf-kitten-pkinit-freshness-07: (with COMMENT) X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 21:36:58 -0000 This is a cryptographically signed message in MIME format. --------------ms070209020407000409070501 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thanks. I've added the RFC editor note now. [1] I'll give the WG a day just-in-case and then send the approval mail. Cheers, S. [1] https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/write= up/ On 20/12/16 21:26, Kathleen Moriarty wrote: > Kathleen Moriarty has entered the following ballot position for > draft-ietf-kitten-pkinit-freshness-07: No Objection >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut this= > introductory paragraph, however.) >=20 >=20 > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.ht= ml > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > Thanks for covering my prior discuss with a paragraph provided as an RF= C > editor note. >=20 >=20 --------------ms070209020407000409070501 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjEyMjAy MTM2NDlaMC8GCSqGSIb3DQEJBDEiBCAutG4f7Iqurohfh9cFKQ5QlePf48pyGKQZR7t7GZUX PDBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQBf5uZE/LBaNaDV8e2FAzTIekp7e37ikgAxIDy0zK+gf3I5NDQ6mDbK kL1UPd2wcamEwbmvsIpbdDB9NspK25CnhekfxaBfO7XukrvQzQe0z41AcHdjSFL70OSK6hGj LdBtGJPeQC8SIgAYGb5IBOXyl9CbQwtFtTK8PvGmHKVB0FuCxERTVTsImtQM8EbcA6VPgp5O RH/RSs8P5ChEHJLmIeNlreJqOjhM6nYH6CZ+QCSY27C7ZEleLzJnadDArjwzMfotVQP463xU LVwdkUFt6v5PpAza7ILf7pmT1IY9jytGGuPavaKY83HlkJsDFawbf42DKjj4gwGuzZz6P6yS AAAAAAAA --------------ms070209020407000409070501-- From nobody Wed Dec 21 18:51:22 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C48F012948D for ; Wed, 21 Dec 2016 18:51:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.901 X-Spam-Level: X-Spam-Status: No, score=-5.901 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3a8uxugtbJY6 for ; Wed, 21 Dec 2016 18:51:20 -0800 (PST) Received: from dmz-mailsec-scanner-4.mit.edu (dmz-mailsec-scanner-4.mit.edu [18.9.25.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D504A12945A for ; Wed, 21 Dec 2016 18:51:19 -0800 (PST) X-AuditID: 1209190f-b17ff700000030f8-d1-585b3fa44088 Received: from mailhub-auth-2.mit.edu ( [18.7.62.36]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id E7.76.12536.4AF3B585; Wed, 21 Dec 2016 21:51:17 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-2.mit.edu (8.13.8/8.9.2) with ESMTP id uBM2pGYD016959 for ; Wed, 21 Dec 2016 21:51:16 -0500 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id uBM2pDhT000974 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Wed, 21 Dec 2016 21:51:16 -0500 Date: Wed, 21 Dec 2016 20:51:13 -0600 From: Benjamin Kaduk To: kitten@ietf.org Message-ID: <20161222025113.GZ8460@kduck.kaduk.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.6.1 (2016-04-27) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrBIsWRmVeSWpSXmKPExsUixG6norvUPjrC4NxcZYujm1exODB6LFny kymAMYrLJiU1J7MstUjfLoEr42Gjb8Erpoqnpy6xNTBOY+pi5OSQEDCRmPV8BVsXIxeHkEAb k8SCc0uYIZzjjBLXT7xihHBeM0ncvraXBaSFRUBV4uTNLjYQm01ARaKh+zIziC0iICyxe+s7 MFtYQEZizdUvYCt4BYwleq7vZoewBSVOznwCNodZQEvixr+XQDUcQLa0xPJ/HCBhUQFliYYZ D5gnMPLOQtIxC0nHLISOBYzMqxhlU3KrdHMTM3OKU5N1i5MT8/JSi3RN9HIzS/RSU0o3MYIC iVOSfwfjnAbvQ4wCHIxKPLwOU6IihFgTy4orcw8xSnIwKYnyntKOjhDiS8pPqcxILM6ILyrN SS0+xCjBwawkwrvFDijHm5JYWZValA+TkuZgURLnvZTpHiEkkJ5YkpqdmlqQWgSTleHgUJLg LQFpFCxKTU+tSMvMKUFIM3FwggznARruZwMyvLggMbc4Mx0if4pRl+PA+xVPmYRY8vLzUqXE ectsgYoEQIoySvPg5oASgET2/ppXjOJAbwnzZoKs4wEmD7hJr4CWMAEtWdgdDrKkJBEhJdXA 6HPn38Tyhb76welt1cf/5PXKOYdJPs4JSPu0KPTE9J+iPvNtCn7KTTK+UxmwTc32zp+qE91e 9UsjreQOJj3iSeC4vlbe/mjARfnXzNW6HIwp9rrRb7ew32v8s37d3clbzz9b6LmXPcQgOmxC ziajvLltOc/yLraLtBsHc2k93jbtzuH1aaFPlViKMxINtZiLihMB5oTaetsCAAA= Archived-At: Subject: [kitten] topics for Chicago? X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Dec 2016 02:51:21 -0000 Hi all, IETF 98 will be in Chicago at the end of March. Hopefully we will be in a position to be taking on new work by then, having cleared a fair number of backlogged documents. Does anyone have topics they want to cover in a possible session in Chicago? If there are no topics to discuss, we will not be requesting a meeting slot. Thanks, Ben From nobody Thu Dec 22 10:26:44 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CFC091294DD; Thu, 22 Dec 2016 10:26:31 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.40.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148243119180.26039.15597951058293292.idtracker@ietfa.amsl.com> Date: Thu, 22 Dec 2016 10:26:31 -0800 Archived-At: Cc: mrogers@redhat.com, kitten-chairs@ietf.org, draft-ietf-kitten-pkinit-freshness@ietf.org, kitten@ietf.org, The IESG , rfc-editor@rfc-editor.org Subject: [kitten] Protocol Action: 'Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) Freshness Extension' to Proposed Standard (draft-ietf-kitten-pkinit-freshness-07.txt) X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Dec 2016 18:26:32 -0000 The IESG has approved the following document: - 'Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) Freshness Extension' (draft-ietf-kitten-pkinit-freshness-07.txt) as Proposed Standard This document is the product of the Common Authentication Technology Next Generation Working Group. The IESG contact persons are Stephen Farrell and Kathleen Moriarty. A URL of this Internet Draft is: https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/ Technical Summary This document describes how to further extend the Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) extension [RFC4556] to exchange an opaque data blob that a KDC can validate to ensure that the client is currently in possession of the private key during a PKINIT AS exchange. Working Group Summary Was there anything in the WG process that is worth noting? For example, was there controversy about particular points or were there decisions where the consensus was particularly rough? Document Quality There is strong consensus for this document, and is the result of active discussion and review among WG members and implementers. There were two main discussion topics that formed this document. The first regarded the choice to specify the freshness token contents as KDC implementation-defined. The token is an element that is both generated and used by the KDC only, being opaque to the client. While there is sometimes the need to have interoperability between KDC-only formats within a realm, there is a precedence within the WG to not standardize these and let the implementations supply documentation on their formats. The other topic was regarding the pre-authentication error code and handling; The initial choice of KDC_ERR_PREAUTH_FAILED was decided as unsuitable for a retriable error and was changed to KDC_ERR_PREAUTH_EXPIRED defined in RFC 6113. Personnel Matt Rogers is the document shepherd. Stephen Farrell is the irresponsible Area Director. RFC Editor Note Please add the following new paragraph to the end of section 7. NEW: If freshness tokens sent by the KDC are too short or too predictable, an attacker may be able to defeat the mechanism by creating signatures using every possible token value. To prevent this attack, the freshness token SHOULD contain a minimum of 64 unpredictable bits. From nobody Thu Dec 22 11:41:18 2016 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 542D9128874; Thu, 22 Dec 2016 11:41:12 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Robert Sparks To: X-Test-IDTracker: no X-IETF-IDTracker: 6.40.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148243567232.26011.10783984451734200377.idtracker@ietfa.amsl.com> Date: Thu, 22 Dec 2016 11:41:12 -0800 Archived-At: Cc: kitten@ietf.org, draft-ietf-kitten-krb-auth-indicator.all@ietf.org, ietf@ietf.org Subject: [kitten] Review of draft-ietf-kitten-krb-auth-indicator-04 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Dec 2016 19:41:12 -0000 Reviewer: Robert Sparks Review result: Ready with Nits I am the assigned Gen-ART reviewer for this draft. The General Area Review Team (Gen-ART) reviews all IETF documents being processed by the IESG for the IETF Chair. Please treat these comments just like any other last call comments. For more information, please see the FAQ at . Document: draft-ietf-kitten-krb-auth-indicator-?? Reviewer: Robert Sparks Review Date: 2016-12-22 IETF LC End Date: 2017-01-06 IESG Telechat date: Not scheduled for a telechat Summary: Ready for publication as Proposed Standard, but with nits that should be considered before advancing Nits/editorial comments: Please remove the 2119 MUST from the Introduction - you already have that requirement expressed in the last paragraph of section 3. If the introduction needs to highlight that the requirement exists, say something similar to "Section 3 requires that elements of this type appear within an AD-CAMMAC container." The 3rd paragraph in section 4 has a MAY in its first sentence that is not an appropriate use of 2119. A lower case "may" is fine here - you're not placing a requirement on implementation. That whole 3rd paragraph looks like an attempt to acknowledge a larger conversation without getting into the meat of that conversation. Rather than make the readers re-discover the problem on their own (right now they have to guess at what the problem really is, with your suggested guidance being the only hint), can you explicitly demonstrate the potential problem? Perhaps pointing to existing discussion in another document would be good? There's bound to be something in our various policy framework documents that captures why you need either only positive or only negative assertions if you are going to be combining them. We ran into pretty much this problem with presence - grep for "positive grants" in RFC5025 for instance. I suspect there's a better reference that I'm just not remembering at the moment. From nobody Sun Dec 25 10:24:49 2016 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0467B12953D; Sun, 25 Dec 2016 10:24:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.301 X-Spam-Level: X-Spam-Status: No, score=-7.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8b1nABdJCe6c; Sun, 25 Dec 2016 10:24:37 -0800 (PST) Received: from dmz-mailsec-scanner-6.mit.edu (dmz-mailsec-scanner-6.mit.edu [18.7.68.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AEE41293DA; Sun, 25 Dec 2016 10:24:33 -0800 (PST) X-AuditID: 12074423-137ff7000000405f-b4-58600ee07ce9 Received: from mailhub-auth-4.mit.edu ( [18.7.62.39]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id AD.22.16479.0EE00685; Sun, 25 Dec 2016 13:24:32 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-4.mit.edu (8.13.8/8.9.2) with ESMTP id uBPIOV4k008943; Sun, 25 Dec 2016 13:24:32 -0500 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id uBPIOR76026136 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Sun, 25 Dec 2016 13:24:30 -0500 Date: Sun, 25 Dec 2016 12:24:28 -0600 From: Benjamin Kaduk To: Robert Sparks Message-ID: <20161225182404.GN8460@kduck.kaduk.org> References: <148243567232.26011.10783984451734200377.idtracker@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <148243567232.26011.10783984451734200377.idtracker@ietfa.amsl.com> User-Agent: Mutt/1.6.1 (2016-04-27) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrBIsWRmVeSWpSXmKPExsUixG6nrvuALyHCYMYrS4u5Lb9ZLK6++sxi 8WzjfBaLo5tXsVhcm9PI5sDqsWTJTyaPWTufsAQwRXHZpKTmZJalFunbJXBlzGtYyFbQIVnR dm4KSwPjXJEuRk4OCQETiTO/pzOB2EICbUwS1/+ydTFyAdkbGSX2XJzLCOFcZZL4v2kTO0gV i4CqxO8XP9hAbDYBFYmG7svMILaIgIbEtSVLwGqYBQokuiZ/ZwGxhQXsJJ5OXwW2gVfAWOJA 7y4WiG1+Ei9mrGeGiAtKnJz5hAWiV0vixr+XQPUcQLa0xPJ/HCAmp4C/xMRZkiAVogLKEg0z HjBPYBSYhaR5FpLmWQjNCxiZVzHKpuRW6eYmZuYUpybrFicn5uWlFuma6eVmluilppRuYgQH sIvyDsaXfd6HGAU4GJV4eCu4EyKEWBPLiitzDzFKcjApifKqbY6JEOJLyk+pzEgszogvKs1J LT7EKMHBrCTCG8IJVM6bklhZlVqUD5OS5mBREue9lOkeISSQnliSmp2aWpBaBJOV4eBQkuB1 5QVqFCxKTU+tSMvMKUFIM3FwggznARq+AKSGt7ggMbc4Mx0if4pRUUqct5AHKCEAksgozYPr BSUYiez9Na8YxYFeEeZdC9LOA0xOcN2vgAYzAQ3Wr48HGVySiJCSamDMNJa03BthfGf60+i4 5tuC//QWVrxheOXZJ3DzcO3TxwtE8rdeWtLmHz8tt4vj5fK1a2q4Xn4zdJ5b/ORIw+kzd6LV ua2LCu4Ze7Cq5Z/OXXZQp7OvetYDZ+ar7XOcwr0z99xYXig/4XBJ7/c7it52KWG7NsiePfHk 31bpiWuun43RDmfLiL6hxFKckWioxVxUnAgAfjrKBAsDAAA= Archived-At: Cc: kitten@ietf.org, gen-art@ietf.org, draft-ietf-kitten-krb-auth-indicator.all@ietf.org, ietf@ietf.org Subject: Re: [kitten] Review of draft-ietf-kitten-krb-auth-indicator-04 X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Dec 2016 18:24:40 -0000 Hi Robert, Thanks for the review (I'm the shepherd, not the editor). On Thu, Dec 22, 2016 at 11:41:12AM -0800, Robert Sparks wrote: > Reviewer: Robert Sparks > Review result: Ready with Nits > > I am the assigned Gen-ART reviewer for this draft. The General Area > Review Team (Gen-ART) reviews all IETF documents being processed > by the IESG for the IETF Chair. Please treat these comments just > like any other last call comments. > > For more information, please see the FAQ at > > . > > Document: draft-ietf-kitten-krb-auth-indicator-?? > Reviewer: Robert Sparks > Review Date: 2016-12-22 > IETF LC End Date: 2017-01-06 > IESG Telechat date: Not scheduled for a telechat > > Summary: Ready for publication as Proposed Standard, but > with nits that should be considered before advancing > > Nits/editorial comments: > > Please remove the 2119 MUST from the Introduction - you already > have that requirement expressed in the last paragraph of > section 3. If the introduction needs to highlight that the > requirement exists, say something similar to "Section 3 > requires that elements of this type appear within an AD-CAMMAC > container." > > The 3rd paragraph in section 4 has a MAY in its first sentence > that is not an appropriate use of 2119. A lower case "may" is > fine here - you're not placing a requirement on implementation. Those first two comments look like good changes to me. > That whole 3rd paragraph looks like an attempt to acknowledge > a larger conversation without getting into the meat of that > conversation. Rather than make the readers re-discover the > problem on their own (right now they have to guess at what > the problem really is, with your suggested guidance being > the only hint), can you explicitly demonstrate the potential > problem? Perhaps pointing to existing discussion in another > document would be good? There's bound to be something in > our various policy framework documents that captures why > you need either only positive or only negative assertions > if you are going to be combining them. We ran into pretty > much this problem with presence - grep for "positive grants" > in RFC5025 for instance. I suspect there's a better reference > that I'm just not remembering at the moment. This is also a good point, but I'm not sure I have a good suggestion of a reference to insert. To give a more concrete example relevant to this document, at the moment, you can authenticate to kerberos in many ways, including with a password, using an OTP value (within a RFC 6113 FAST tunnel), and with PKINIT asymmetric crypto. One might be tempted to put in a value "without-password" to indicate that a password was not used, but when an application server goes to consume that authentication indicator, the assumption might be that without-password means PKINIT, which is arguably a stronger authentication than the OTP method. Thus, there is the possibility of the application server would make a bad decision based on the negative "without-password" indicator, in contrast to an explicit "pkinit" or "otp" indicator. -Ben