From nobody Fri Nov 2 03:12:24 2018 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50C4712F1A5 for ; Fri, 2 Nov 2018 03:12:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=openfortress.nl Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JzMxowam76SP for ; Fri, 2 Nov 2018 03:12:19 -0700 (PDT) Received: from lb2-smtp-cloud7.xs4all.net (lb2-smtp-cloud7.xs4all.net [194.109.24.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7ECB01288BD for ; Fri, 2 Nov 2018 03:12:16 -0700 (PDT) Received: from popmini.vanrein.org ([83.161.146.46]) by smtp-cloud7.xs4all.net with ESMTP id IWR2gdr7kw2L8IWR3gHYMY; Fri, 02 Nov 2018 11:12:14 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openfortress.nl; i=rick@openfortress.nl; q=dns/txt; s=fame; t=1541153526; h=message-id : date : from : mime-version : to : cc : subject : references : in-reply-to : content-type : content-transfer-encoding : date : from : subject; bh=nsSOCLyjiyFRnWlK3lcj46CUyvC7muOgu1j2ADtTAoY=; b=Tymv8tO5JDWx4N/YqW89iV7F9y3/lorU639k7Xkz8tFfrLmWRy6wwEUh w2inT0sSOjkzydAZXaH6kmfFJrpK5z8yxEwSRGU6NZA7AqF8xkBqVheNkT uFo+CYSHLNtL1yVRyTnqSywxdIlnvjXGLTBX/IcHKmeGDOPDoihKmYq+M= Received: by fame.vanrein.org (Postfix, from userid 1006) id 8ED2B21D55; Fri, 2 Nov 2018 10:12:06 +0000 (UTC) X-Original-To: kitten@ietf.org Received: from airhead.local (phantom.vanrein.org [83.161.146.46]) by fame.vanrein.org (Postfix) with ESMTPA id 2964A21D53; Fri, 2 Nov 2018 10:12:05 +0000 (UTC) Message-ID: <5BDC22F3.2060804@openfortress.nl> Date: Fri, 02 Nov 2018 11:12:03 +0100 From: Rick van Rein User-Agent: Postbox 3.0.11 (Macintosh/20140602) MIME-Version: 1.0 To: Nico Williams CC: "kitten@ietf.org" References: <5BD6BC1F.5000800@openfortress.nl> <3777aea8-4799-e58f-391d-42006b693d85@mit.edu> <5BD836A1.5060200@openfortress.nl> <20181030151944.GG2486@localhost> In-Reply-To: <20181030151944.GG2486@localhost> X-Enigmail-Version: 1.2.3 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Bogosity: Unsure, tests=bogofilter, spamicity=0.520000, version=1.2.4 X-CMAE-Envelope: MS4wfLWtqncuVlB83lNbtovihWvP1iL0JvIQmO+fK+q65EzSaJvXB+19EOel1x/fLZ2z6STm1etgSb1YfzfUZ244k1lWazqR1X6IL1nacE0jOYRa2hV7ndzp frf3v1OnuyzLo8nmDWtOk91gSaau64Pc6xPJjvgICTihn1gG3rsAiL7n Archived-At: Subject: Re: [kitten] User-to-user Kerberos in GSS-API X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Nov 2018 10:12:23 -0000 Hi, >> 1. The service may declare its realm; in other Kerberos >> protocols that is considered to be a no-go area. > > I don't follow. Usually, when a service can declare a realm, it is given an opportunity to sidetrack credentials to that choice of realm. Other Kerberos applications choose to infer the realm on the client or in his KDC, which can be a nuisance, but a secure nuisance. > StartTLS is a feature of protocols like SMTP, SUBMIT, IMAP, and so on -- > generally SASL apps. (HTTP has a StartTLS that is not implemented and > nobody uses.) Where would you use StartGSS? Not completely sure yet, I want to experiment with it. Possible places could be (1) as an alternative to StartTLS and (2) as an end-to-end facility within a client-server connection. I like the model of SASL-within-TLS, but only from the perspective of authentication; it leaves things to be desired concerning end-to-end encryption, which TLS tries very hard to avoid. I'm also wondering what Quantum Crypto would change; for instance, OpenSSH looses its secure status but could benefit from mixing the Kerberos session key with the (EC)DH shared key. (That's what we did in TLS-KDH too.) -Rick From nobody Mon Nov 5 07:59:48 2018 Return-Path: X-Original-To: kitten@ietf.org Delivered-To: kitten@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F64A130DE7; Mon, 5 Nov 2018 07:59:40 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: kitten@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.87.3 Auto-Submitted: auto-generated Precedence: bulk Reply-To: kitten@ietf.org Message-ID: <154143357994.4106.6178135815650481454@ietfa.amsl.com> Date: Mon, 05 Nov 2018 07:59:40 -0800 Archived-At: Subject: [kitten] I-D Action: draft-ietf-kitten-pkinit-alg-agility-03.txt X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Nov 2018 15:59:40 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Common Authentication Technology Next Generation WG of the IETF. Title : PKINIT Algorithm Agility Authors : Love Hornquist Astrand Larry Zhu Margaret Wasserman Greg Hudson Filename : draft-ietf-kitten-pkinit-alg-agility-03.txt Pages : 18 Date : 2018-11-05 Abstract: This document updates PKINIT, as defined in RFC 4556, to remove protocol structures tied to specific cryptographic algorithms. The PKINIT key derivation function is made negotiable, the digest algorithms for signing the pre-authentication data and the client's X.509 certificates are made discoverable. These changes provide preemptive protection against vulnerabilities discovered in the future against any specific cryptographic algorithm, and allow incremental deployment of newer algorithms. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-alg-agility/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-kitten-pkinit-alg-agility-03 https://datatracker.ietf.org/doc/html/draft-ietf-kitten-pkinit-alg-agility-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-kitten-pkinit-alg-agility-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/