[kitten] Kitten and Krb-wg Merger

[Shawn M Emery <[e-mail]>]

In light of the pending merger between the kitten and Kerberos WGs we 
have compiled a list of possible work items to start the 
merger/recharter discussions during the combined session on Tuesday.  We 
are looking for feedback on this and other items that should be 
considered for the new charter.

GSS-API related
-------------
  * Provide new interfaces for credential management, which include the
     following:
        initializing credentials
        iterating credentials
        exporting/importing credentials

     * Specify interface for asynchronous calls.

     * Negotiable replay cache avoidance

     * Define interfaces for better error message reporting.

     * Provide a more programmer friendly GSS-API for application 
developers.
       This could include reducing the number of interface parameters, for
       example, by eliminating parameters which are commonly used with the
       default values.

     * Specify an option for exporting partially-established security
       contexts and possibly a utility function for exporting security
       contexts in an encrypted form, as well as a corresponding utility
       function to decrypt and import such security context tokens.

Kerberos related
--------------
     * Prepare and advance one or more standards-track specifications which
       update the Kerberos version 5 protocol to support non-ASCII principal
       and realm names, salt strings, and passwords, and localized error
       reporting.  Maximizing backward compatibility is strongly desired.

     * Prepare and advance one or more standards-track specifications which
       update the Kerberos version 5 protocol in a backward-compatible way
       to support extending the unencrypted portion of a Kerberos ticket.

     * Prepare, review, and advance standards-track and informational
       specifications defining new authorization data types for carrying
       supplemental information about the client to which a Kerberos ticket
       has been issued and/or restrictions on what the ticket can be used
       for. To enhance this ongoing authorization data work, a container
       format supporting the use cases of draft-sorce-krbwg-general-pac-01
       may be standardized.

     * Prepare a standards-track protocol to solve the use cases addressed
       by draft-hotz-kx509-01 including new support for digital signatures.

     * Prepare and advance one or more standards-track specifications
       which define mechanisms for establishing keys and configuration
       information used during authentication between Kerberos realms.

     * Prepare and advance a standards-track specification defining a
       format for the transport of Kerberos credentials within other
       protocols.

     * Today Kerberos requires a replay cache to be used in AP exchanges in
       almost all cases.  Replay caches are quite complex to implement
       correctly, particularly in clustered systems. High-performance replay
       caches are even more difficult to implement.  The WG will pursue
       extensions to minimize the need for replay caching, optimize replay
       caching, and/or elide the need for replay caching.

     * Produce an LDAP schema for management of the KDC's database.

Shawn.
kitten and krb-wg co-chair
--