Re: [dhcwg] Comments on draft-ietf-dhc-pktc-kerb-tckt-00.txt

>>>>> "Paul" == Paul Duffy <paduffy@cisco.com> writes:

    Paul> I sense that your main objection to this draft is that it
    Paul> implies that PacketCable Security is not 100% RFC 1510
    Paul> compliant.  Will one or two lines clarifying this, along
    Paul> with a ref to the PacketCable Security spec, suffice?

That's my only objection to the existence of the draft yes.  AS you
point out the IESG has already decided they disagree with me, so this
objection should be ignored.

    Paul> Something along the line of...

    Paul> "Note that the PacketCable Security Specification differs
    Paul> from RFC 1510, see [ref] for full technical details of
    Paul> PacketCable's Kerberos implementation".

Looks good.

    Paul> Agreed.  Service authorization is a bogus/incorrect
    Paul> argument. The text...

    Paul> "The service provider requires this capability to support
    Paul> operational functions such as disabling a subscriber's
    Paul> service, forcing re- establishment of security associations,
    Paul> or for testing and remote diagnostic of CCDs. "

    Paul> ...needs to be changed to something like...

    Paul> "The service provider requires this capability to support
    Paul> operational functions such as forcing re-establishment of
    Paul> security associations or for testing and remote diagnostic
    Paul> of CCDs. "

Sounds reasonable.

    Paul> I share Kens concerns re: forcing all tickets to expire.
    Paul> Public key ops are expensive and we try to avoid them when
    Paul> possible (for scaling reasons, avalanche restart conditions,
    Paul> etc.).

But you should only need a PKI op for the TGT not for each service
ticket.

_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg