From nobody Tue Feb 4 10:15:20 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C276F12013B for ; Tue, 4 Feb 2020 10:15:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.736 X-Spam-Level: X-Spam-Status: No, score=0.736 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SBL_CSS=3.335, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9N-NrfHPTe8U for ; Tue, 4 Feb 2020 10:15:15 -0800 (PST) Received: from be.cityemail.com (mail-ob.cityemail.com [104.128.152.19]) by ietfa.amsl.com (Postfix) with ESMTP id 99743120131 for ; Tue, 4 Feb 2020 10:15:15 -0800 (PST) Received: (qmail 39639 invoked from network); 4 Feb 2020 18:15:15 -0000 Received: from riddle.wizard.ca (HELO [192.168.1.55]) (michael@wizard.ca@104.128.144.8) by be.cityemail.com with (AES128-SHA encrypted) SMTP (4a9390de-477a-11ea-94f8-bf1f0e42464a); Tue, 04 Feb 2020 10:15:15 -0800 From: Michael Peddemors To: extra@ietf.org, ietf-smtp@ietf.org, kitten@ietf.org Organization: LinuxMagic Inc. Message-ID: <0b833564-8502-c100-4c4b-c94937e4f40d@linuxmagic.com> Date: Tue, 4 Feb 2020 10:15:15 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-MagicMail-OS: Linux 3.11 and newer X-MagicMail-UUID: 4a9390de-477a-11ea-94f8-bf1f0e42464a X-MagicMail-Authenticated: michael@wizard.ca X-MagicMail-SourceIP: 104.128.144.8 X-MagicMail-RegexMatch: 0 X-MagicMail-EnvelopeFrom: X-Archive: Yes Archived-At: Subject: [kitten] [FEEDBACK REQUEST] "Birds of a Feather (BOF)" on Email Security X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2020 18:15:17 -0000 It was suggested I cross post to these list(s), with only a few days left before the deadline for requesting a "Birds of a Feather" session, I am proposing that a meeting be held in Vancouver for a BOF suggestion surrounding all those that are interested in solving problems around email security. Specifically, to determine how wide or narrow the scope of such a session should be.. we can discuss how IETF can weigh in some of our largest threats (such as POP and SMTP authentication over unencrypted networks is still enshrined in RFC's) various proposals for multi-factor authentication, improvements to the protocols to support other methods, such as our own CLIENTID as trust factors, access control tools, or two factor authentication, and any other topics that span across all email protocols. Email security is one of the largest threats today, and it is an opportunity to weigh in what role the IETF can play in improving the situation. The thread is posted on the 'art@ietf.org' mailing list, and would like to see your feedback on what other cross protocol issues might be included, and or discussed as part of this BOF. And of course, please feel free to chime in if you feel that this BOF should be more narrowly focused, or wider focused. -- Michael -- PS, Look forward to seeing everyone in Vancouver. -- "Catch the Magic of Linux..." ------------------------------------------------------------------------ Michael Peddemors, President/CEO LinuxMagic Inc. Visit us at http://www.linuxmagic.com @linuxmagic A Wizard IT Company - For More Info http://www.wizard.ca "MagicSpam" is a Registered TradeMark of Wizard Tower TechnoServices Ltd. ------------------------------------------------------------------------ 604-682-0300 Beautiful British Columbia, Canada This email and any electronic data contained are confidential and intended solely for the use of the individual or entity to which they are addressed. Please note that any views or opinions presented in this email are solely those of the author and are not intended to represent those of the company. -- "Catch the Magic of Linux..." ------------------------------------------------------------------------ Michael Peddemors, President/CEO LinuxMagic Inc. Visit us at http://www.linuxmagic.com @linuxmagic A Wizard IT Company - For More Info http://www.wizard.ca "LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd. ------------------------------------------------------------------------ 604-682-0300 Beautiful British Columbia, Canada This email and any electronic data contained are confidential and intended solely for the use of the individual or entity to which they are addressed. Please note that any views or opinions presented in this email are solely those of the author and are not intended to represent those of the company. From nobody Tue Feb 4 11:24:52 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43CC112016E for ; Tue, 4 Feb 2020 11:24:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=redhat.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4I32beOAu6E6 for ; Tue, 4 Feb 2020 11:24:47 -0800 (PST) Received: from us-smtp-delivery-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 544F112088B for ; Tue, 4 Feb 2020 11:24:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1580844286; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=ep0tFzBgTen4vwrbHYKB8xk6hkKcUItWQp6qm48Nn58=; b=gS82VSzwi/wJ+9Vwehs4+xVd8ktOauXM1TV7ETPJUC/o2gFA6L0r1mvUA7Du+XdIgICWSx lnM50H6dUe6TSLIGwfoBW5NwSXUN6Mj/oU1Jc09HgMNy20N9zVX3DIKvLPD4yqVkJe/TyA U8+3PlhWwhW9T+O/omg4sZ286SMILbM= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-409-kIMzDtmaM6SOFjjfJtvKKg-1; Tue, 04 Feb 2020 14:24:43 -0500 X-MC-Unique: kIMzDtmaM6SOFjjfJtvKKg-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 9073E18FE861; Tue, 4 Feb 2020 19:24:42 +0000 (UTC) Received: from localhost (dhcp-10-20-1-106.bss.redhat.com [10.20.1.106]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5677785750; Tue, 4 Feb 2020 19:24:42 +0000 (UTC) From: Robbie Harwood To: Michael Peddemors , kitten@ietf.org In-Reply-To: <0b833564-8502-c100-4c4b-c94937e4f40d@linuxmagic.com> References: <0b833564-8502-c100-4c4b-c94937e4f40d@linuxmagic.com> Date: Tue, 04 Feb 2020 14:24:46 -0500 Message-ID: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Archived-At: Subject: Re: [kitten] [FEEDBACK REQUEST] "Birds of a Feather (BOF)" on Email Security X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2020 19:24:51 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Michael Peddemors writes: > It was suggested I cross post to these list(s), with only a few days > left before the deadline for requesting a "Birds of a Feather" > session, I am proposing that a meeting be held in Vancouver for a BOF > suggestion surrounding all those that are interested in solving > problems around email security. > > Specifically, to determine how wide or narrow the scope of such a > session should be.. we can discuss how IETF can weigh in some of our > largest threats (such as POP and SMTP authentication over unencrypted > networks is still enshrined in RFC's) various proposals for > multi-factor authentication, improvements to the protocols to support > other methods, such as our own CLIENTID as trust factors, access > control tools, or two factor authentication, and any other topics that > span across all email protocols. > > Email security is one of the largest threats today, and it is an=20 > opportunity to weigh in what role the IETF can play in improving the=20 > situation. > > The thread is posted on the 'art@ietf.org' mailing list, and would like= =20 > to see your feedback on what other cross protocol issues might be=20 > included, and or discussed as part of this BOF. > > And of course, please feel free to chime in if you feel that this BOF=20 > should be more narrowly focused, or wider focused. > > =09-- Michael -- > > PS, Look forward to seeing everyone in Vancouver. Hi, thanks for reaching out! kitten does not plan to hold a session in Vancouver, so I don't know how many of us will be present, but I hope the BoF goes well. Thanks, --Robbie -- Robbie Harwood Chair, IETF kitten WG --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEA5qc6hnelQjDaHWqJTL5F2qVpEIFAl45xP4ACgkQJTL5F2qV pEKOqA/+PmHDFuXaz4b3bkCnEDajsLtV3Ai0wf0+MK7V/tap7+aLDlXLcFux6BRo YQLq5ult4vdqLiObg+nmaJRst0qj8WZBAYkNb1gWXJMWteQtOSCs+XQ3X8dbii// BcbPcF5WO2Y2a0Ft3N2155Q214a5KnBaFQd4LSOlWEBy2MBiM6BeTEZGhucXx+Eu gEVaGQhktTJFRXIQvImdZepHfGAXeMmAEXlqs34tZGgfWXbElg+5ca93jxH73S7W tG+xE1nDXNZWIbbpf8FYq/SFBO6eVlbCv0ysHCp+fouIIe1pcHto/1V4aJrrBLkk x24DXnn85lKvtZs41ygrwnxQGKRt0ssV8pmWwLH/+hdABbVDlmZupR+oIYGjLDjb vC6GNsm9uU2mRrLH19n5NCA2vzhs0fhui7m1jpr71yrhulX3NWsEnBuF8BPaFat7 rBC4Rc7ffPEbmtV7e3mHzd3roxz//9p0sC300kjxTvgjBJJylqEb6DrMgsgc5Qys K3SL6JdLpcLMuv++gvSTzhP1+3ogWZ838O4flKTjmooFdW8XspyHw/hOujhCWch7 IKZEp58aske7rGQcBM3TXq9pyQ3nlzMrW6XM6UZYbR+C8+Ma9AhRiscTA6IbMk7/ dV5b8N1xeKSRDcfFEB8n40rj10tRWJckQYRfsc+TC9n3EYF+2N0= =kom5 -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Feb 7 04:26:31 2020 Return-Path: X-Original-To: kitten@ietfa.amsl.com Delivered-To: kitten@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 389FA12023E for ; Fri, 7 Feb 2020 04:26:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CNHBkzND_bmx for ; Fri, 7 Feb 2020 04:26:28 -0800 (PST) Received: from mail-lf1-x129.google.com (mail-lf1-x129.google.com [IPv6:2a00:1450:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DFD2C120836 for ; Fri, 7 Feb 2020 04:26:27 -0800 (PST) Received: by mail-lf1-x129.google.com with SMTP id z26so1380590lfg.13 for ; Fri, 07 Feb 2020 04:26:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Dv9wvP3KHXa1E5JYZzJizwfRahjh6d3QSksZ49PxBlo=; b=qfCnWExxMuPcJz19CTGOA2Qgi3zL/7QZ+yB2PPFg2WiFBrl+37bxmpc2Ete69ce0lh 9/R6R9PzaybyNXorMAmRhEAAHtGVdumiQ+wFAKDNDvMiWkUDyD4kuDzb9Jp6BnZGMbHn M+tQG4dUmaDrSdfnXHPgAbs6s6E3RvO6m8mZCF3UFMCPzj6euExrtfst5hkUiq2HWbt+ RsqtyRW6+kZ02lhgW4NH19SV0oAHkfiftwopi5uUzD9nyrJjiNisGGChCTCnHN0YZq0I He9A4Ay6pGj0M+ynhgzU2nZQ+ON6okQDGO4bAHnMtfV3A6tMISOdZVUq4ySFop4Mf2Xa /7Mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Dv9wvP3KHXa1E5JYZzJizwfRahjh6d3QSksZ49PxBlo=; b=R3HO6t7UP1JSDT/h2Y/Gvk0vZBxkkwW99qIAs0NolaG80CiBQ6dziVtl2CajmoOkka QeEQALl6c+qazwGzH7rkICeNg+ZreV/VDi2g5u26hQz5Pfe4bjwmcaiZlOZdEevPJYOd l7mf4KP0WHoOed7YeIQfibHeqlvbAUT14Fc3hTxZISu9iAMoIhRNWR2dxpUoTNR2M+sD MFaAvS2vuBy8blFe2R0vpzkyn7iNDw/grBVxvdDCuu2Zf/dkoBlRXkQiw6f5nRC5TQao AlOyuV41luQhWde/v/EKvV1NQPGx4Y+kXlfZNMn53Yqollkwpn5jft9PVUTJ3rfKAQ0j 3ROQ== X-Gm-Message-State: APjAAAV1/woyzr6Rc9AWXDO+2ARUkycuD06cQX/aV65HoEpJ4Zg+Te+J QZipoVKyux5+4/uRGETYy5WMqLqjNGatC7+kcM/souTt X-Google-Smtp-Source: APXvYqzr2wQvMemibqCzeNPyKHqqpQoHj3NKfPKDX0qPKo6Uwpv5xAEseQG459cIo1nqrtmdWXaHvJW42m21LS6YwFI= X-Received: by 2002:ac2:5f65:: with SMTP id c5mr4471962lfc.207.1581078385999; Fri, 07 Feb 2020 04:26:25 -0800 (PST) MIME-Version: 1.0 References: <69d80d24-d461-1652-3cfb-e55d90d31fbf@samba.org> <1503578184.3428.19.camel@redhat.com> <1503596189.3428.26.camel@redhat.com> <8f68cfb0-2d6b-d86f-4ff0-a9282aa0bf55@samba.org> <20191121223908.GC26241@localhost> <22f96c93-0217-0b2b-d7e1-684f9269fba4@samba.org> <20191122224526.GA28614@localhost> In-Reply-To: <20191122224526.GA28614@localhost> From: Isaac Boukris Date: Fri, 7 Feb 2020 13:26:14 +0100 Message-ID: To: Nico Williams Cc: Stefan Metzmacher , "heimdal-discuss@sics.se" , Samba Technical , "krbdev@mit.edu Dev List" , kitten@ietf.org Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [kitten] Checking the transited list of a kerberos ticket in a transitive cross-realm trust situation... X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Feb 2020 12:26:30 -0000 Hi, On Fri, Nov 22, 2019 at 11:45 PM Nico Williams wrote: > > On Fri, Nov 22, 2019 at 11:24:44AM +0100, Stefan Metzmacher wrote: > > > Correspondingly and symmetrically, the right way to request some > > > behavior on the side where the credential is available, is to associate > > > that request with the desired_name for which the credential is acquired. > > > > So you mean we need to pass an explicit desired_name to > > gss_acquire_cred_from() and use gss_set_name_attribute() calls > > (for no_transit_check and iterate_acceptor_keytab) on that desired_name > > before? > > Oh, wait, right. That's not going to work when you want a default > credential. Maybe the name-attributes can be made complementary to the proposed credential-options, if a service wishes to inquire this info.