Subject: [saag] Kitten Summary - IETF 86

From: Shawn M Emery <[email-masked]>
Date: Thu, 14 Mar 2013 12:06:03 -0600

Co-chairs Attending: Sam Hartman and Shawn Emery

The WG met for the morning session on Thursday (3.14.13).

kitten and Krb-wg merger
------------------------
New charter has been approved.
Krb-wg members have been migrated to the kitten list.
Updated drafts should be prefixed with draft-kitten-*.

draft-ietf-kitten-gssapi-extensions-iana
----------------------------------------
Leif had feed-back.  Chairs will send through another WGLC to get more reviewers. An
initial registry was suggested to provide guidance.

draft-ietf-kitten-sasl-saml-ec
------------------------------
Update was made with simplified session key schema, random-to-key moved to endpoints,
and advertisement of session key and enc types by acceptor.

draft-ietf-krb-wg-kdc-model
---------------------------
In RFC editor queue.  Was needing updates based on RFC editor comments/questions.

draft-ietf-krb-wg-pkinit-alg-agility
------------------------------------
RFC 3766 and RFC 6194 should be informative.
Error code 82 conflict should be reassigned.  Deployed code but impact unlikely.

draft-ietf-krb-wg-kerberos-referrals
------------------------------------
Now RFC 6806.

draft-sakane-dhc-dhcpv6-kdc-option
----------------------------------
Now RFC 6784.

draft-ietf-krb-wg-camellia-cts
------------------------------
Now RFC 6803.

draft-ietf-kitten-sasl-oauth
----------------------------
Jeff Hutzelman had made WGLC comments that entail an GSS-API abstract violation due to the
use of the mutual authentication state to indicate that the application, not the mechanism
has performed mutual authentication.  The other two SASL mechanisms, OpenID and SAML,
have similar issues.  It was decided that there should be an interim meeting to discuss
whether we update GS2 to provision for these mechanism types or do we remove the GS2
capabilities of these SASL mechanisms.

draft-ietf-kitten-kerberos-iana-registries
------------------------------------------
New revision was made that specifies registry fields.
Consensus during the session was made to NOT create registries for:
	Application tag numbers
	Transited encoding types

New Drafts Proposed
-------------------
draft-williams-kitten-channel-bound-flag
Would not require a recharter as it corrects an existing issue with channel binding.

draft-williams-kitten-krb5-extra-rt
Would require a recharter.

draft-williams-kitten-krb5-rcache-avoidance
Already in the current charter.

draft-yu-kitten-kerberos-kdc-does-aliases
Would require a recharter.

There wasn't enough review of the above drafts by members in the room to make a call to
adopt the relevant drafts in the WG.

Open Mic
--------
No one came forward.

GSS-Profile
-----------
Sam had commented on this draft as being useful in simplifying the GSS-API.  There were
not enough reviewers in the room to make a call for adoption.  Unfortunately a charter item
(i.e. draft-yu-kitten-api-wishlist) similar to this was previously removed due to lack of
feed-back or interest.

Shawn.
--
kitten co-chair

---

From: Nico Williams <[email-masked]>
Date: Thu, 14 Mar 2013 13:18:05 -0500

> The WG met for the morning session on Thursday (3.14.13).

Sorry I could not attend.

> draft-ietf-kitten-sasl-oauth

Basically, any mechanism that does not do mutual auth could still be
used with GS2 if we relax the mutual auth requirement there, but we
must not allow such mechanisms to be advertised as -PLUS mechanisms.

> Would require a recharter.

Some of it relates to rcache avoidance, FYI, which is in charter.
Mind you, I think we should modify the charter.

Also, if mechanism work is in charter then I'd think that
maintenance/extensions work on existing mechanisms should be as well.
If that's not already clearly stated in the charter, then we should
make it so.

> Would require a recharter.

I support modifying the charter so we can adopt this I-D (as well as,
unsurprisingly, mine).

> No one came forward.

FYI, Nathan McCallum has convinced me to specify a subset of the verto
API (which is quite simple) for async GSS.

> GSS-Profile

Which I-D was this?  draft-williams-gss-profiles?

Nico
--

---

From: Shawn M Emery <[email-masked]>
Date: Thu, 14 Mar 2013 13:31:45 -0600

On 3/14/13 12:18 PM, Nico Williams wrote:
> <...> 

Yes, that was meant to be plural.

Shawn.
--