Subject: Keyboard-interactive: device names and IANA

From: Martin Forssen <[email-masked]>
Date: Thu, 14 Dec 2000 13:58:40 -0800 (PST)

I did some thinking about the section in the keyboard-interactive draft
which states that device-names should be registered by IANA. I reached
the conclusion that I do not think this is necessary.

The device-names is a field which the server MAY care about. The client
will (most probably) not have any knowledge about which devices are
available to the user so the contents of this field will probably be up
to the user (via a preferences field or option).

The net effect of this is that the actual device-name to use is
something which the user and the server must agree upon. Thus this is
not something which is needed for the compatibility between the server
and the client. I also think we can assume that the user has knowledge
about which device-name to use on the server since there already has to
be interaction between them to initialize tokens etc.

All this means that registering device-names with IANA does not help
compatibility and only creates administrative overhead. Therefore I
suggest we remove the reference to IANA from the keyboard-interactive
draft.

Comments?

	/MaF

---

From: Sami Lehtinen <[email-masked]>
Date: Fri, 15 Dec 2000 01:53:59 +0200

Martin Forssen, on December 14. 2000, wrote:
[snip]
  : All this means that registering device-names with IANA does not help
  : compatibility and only creates administrative overhead. Therefore I
  : suggest we remove the reference to IANA from the keyboard-interactive
  : draft.

Example: securid

What if your implementation calls it 'securid' and ours calls it
'securid@ssh' and some other calls it
[email-masked]'. We don't have much
compatibility then.

But do we care?

-- 
[[email-masked]          --  Sami J. Lehtinen  --           [email-masked]]
[work:+358 9 85657425][gsm:+358 50 5170 258][http://www.iki.fi/~sjl]
[SSH Communications Security Corp               http://www.ssh.com/]

---

From: Bill Sommerfeld <[email-masked]>
Date: Thu, 14 Dec 2000 19:15:39 -0500

> suggest we remove the reference to IANA from the keyboard-interactive

[wg chair hat off]

I agree.  My understanding is that the device name is an optional way
for an end-user to identify which of several possible devices in their
possession they could use to authenticate.  Conceivably, I might have
two (differently keyed) securid cards or two sets of s/key state or...

Anyone got a better name for this than "device"?

						- Bill

---

From: Martin Forssen <[email-masked]>
Date: Thu, 14 Dec 2000 17:13:11 -0800 (PST)

> [email-masked]'. We don't have much

Sure they are compatible, they just expect the user to enter different
things into a field. We should also remember that in the overwhelming
majority of cases users will only have one device available and this
field is unneeded.

	/MaF

---

From: Martin Forssen <[email-masked]>
Date: Thu, 14 Dec 2000 17:13:19 -0800 (PST)

> Anyone got a better name for this than "device"?

The only alternative we could think of was "token" but we preferred
"device". But then again english is not my native language...

	/MaF

---

From: Darren J Moffat <[email-masked]>
Date: Mon, 18 Dec 2000 09:43:02 -0800 (PST)

> Anyone got a better name for this than "device"?

What about "mechanisms".

--
Darren J Moffat

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 18 Dec 2000 13:34:33 -0500

> > Anyone got a better name for this than "device"?

as i understand it, the field in question was meant to select between
multiple cards given to a single user.  

those two cards could be identical (i.e., two securid cards or two
enigma cards), so the "mechanism" would be the same, the only
difference is the keying material in the device.

"instance" would better reflect the way it's used but would be even
more incomprehensible to novices..

					- Bill

---

From: Martin Forssen <[email-masked]>
Date: Tue, 19 Dec 2000 09:26:40 +0100 (MET)

On 18 Dec, Bill Sommerfeld wrote:
>> > > All this means that registering device-names with IANA does not
>> > > help compatibility and only creates administrative overhead.
>> > > Therefore I suggest we remove the reference to IANA from the
>> > > keyboard-interactive draft.
>> > 

That was not the intent. I think the cases where one user has multiple
cards which all goes to the same account are extremely rare. 

> more incomprehensible to novices..

Fortunately the users do not have to be exposed to the names used in the
RFC, but they probably will. That is we can add explanatory text to the
RFC but most implementors will probably use the name given anyway:-/

I am not sure I like "mechanism" (a purely subjective point of view
though). I still think devices is a better name.

Perhaps i is easier to find the right word if we try to list some
possible values. The ones I can think of right now are: securid,
cryptocard, desgold, s/key, opie.

Perhaps "method" (or "submethod") is a better name than device, we just
have to be clear in the RFC.

	/MaF

---

From: Sami Lehtinen <[email-masked]>
Date: Wed, 20 Dec 2000 14:35:18 +0200

Martin Forssen, on December 19. 2000, wrote:
  : Perhaps "method" (or "submethod") is a better name than device, we just
  : have to be clear in the RFC.

"submethod". hmm... good, good,..

(calling it just "method" would be too similar with the wording in
userauth, in my opinion ("authentication methods", IIRC).)