Protocol Action: 'GSS-API Internationalization and Domain-Based Service Names and Name Type' to Proposed Standard

The IESG has approved the following documents:

- 'GSS-API Internationalization and Domain-Based Service Names and Name 
   Type '
   <draft-ietf-kitten-gssapi-domain-based-names-06.txt> as a 
   Proposed Standard
- 'GSS-API Domain-Based Service Names Mapping for the Kerberos V GSS 
   Mechanism '
   <draft-ietf-kitten-krb5-gssapi-domain-based-names-05.txt> as a 
   Proposed Standard

These documents are products of the Kitten (GSS-API Next Generation) 
Working Group. 

The IESG contact persons are Sam Hartman and Tim Polk.

A URL of this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-kitten-gssapi-domain-based-names-06.txt

Technical Summary

   This documentset  describes domainname-based service principal names
and
   the corresponding name type for the Generic Security Service
   Application Programming Interface (GSS-API) and the GSS-API
Kerberos 5 mechanism.

   Domain-based service names are similar to host-based service names,
   but using a domain name (not necessarily an Internet domain name) in
   addition to a hostname.  The primary purpose of domain-based names is
   to provide a measure of protection to applications that utilize
   insecure service discovery protocols.  This is achieved by providing
   a way to name clustered services after the "domain" which they
   service, thereby allowing their clients to authorize the service's
   servers based on authentication of their service names.

Working Group Summary

   The Kitten Working Group has achieved consensus that
   this document should be published as a Proposed Standard.  Two weeks
   of discussion of the document and how applications would need to
   be modified to make use if its specification were extended by an
   additional week in order to reach consensus on additional examples.

Protocol Quality

   This document has been reviewed by Sam Hartman for the IESG.

Note to RFC Editor

Create a new section after section 5:
x.  IANA Considerations

   The IANA should record the following new name-type OID in the IANA's
   "SMI Security for Name System Designators Codes (nametypes)"
   registry:

      5   gss-domain-based                                      [RFCxxxx]

   Add to the end of section 6 (Security Considerations):

   Note that, as with all service names, the mere existence of a
  domain-based service name conveys meaningful information that may be
  used by initiators for making authorization decisions; therefore,
  administrators of distributed authentication services should be
  aware of the significance of the service names for which they create
  acceptor credentials."

_______________________________________________
IETF-Announce mailing list
IETF-Announce@ietf.org
https://www.ietf.org/mailman/listinfo/ietf-announce