Re: [kitten] [EXTERNAL] Re: Windows Intent to revive and implement IAKerb draft-ietf-kitten-iakerb-03

[Nico Williams <[e-mail]>]

On Tue, Feb 21, 2023 at 11:54:06AM +1100, Luke Howard Bentata wrote:
> > On 21 Feb 2023, at 11:44 am, Nico Williams <[e-mail]> wrote:
> >> There are good reasons why Kerberos is still around; the shortcomings of
> >> other systems are among them.  But there's been zero work in 30 years on
> >> making Kerberos easy to deploy, orchestrate, and operate.  [...]
> > 
> > Ah, not to give offense to folks like Simo and Roland that have done a
> > lot of work in that space.  I was referring to IETF work.
> 
> Not to mention Microsoft: authorisation data without a separate
> privilege service,* protocol transition, enctype negotiation,
> constrained delegation, AEAD in GSS, IAKERB, PKU2U, reply cache
> avoidance (DCE_STYLE), plus their contributions to anonymity and FAST.

Those don't help with orchestration or operation though.

I didn't say _no_ work happened on Kerberos.

I'm referring to things like RFC 3244 being the only RFC (Informational
at that) for password changes or key changes.  The only other thing we
have in that space is an LDAP schema, but it doesn't necessarily with
AD, right?  And many sites don't use either.

Nico
--