Re: [kitten] Updating IANA krb5 GSSAPI token type registry

[Benjamin Kaduk <[e-mail]>]

Digging up an old thread....

The wheels of progress have slowly spun, and the registry at 
http://www.iana.org/assignments/kerberos-v-gss-api/kerberos-v-gss-api.xhtml#token-types 
has been updated to include the rest of the token types from RFC 4121, and 
the values from RFCs 1964 and 6880.  As expected, values from in-progress 
I-Ds were not included.

In particular, the value 0405 from draft-ietf-krb-wg-gssapi-cfx-02 which 
was removed before that document became RFC 4121, and the value 0501 from 
draft-ietf-kitten-iakerb-00 (now -01), were not added.  Apparently they 
were declined on the grounds that they don't meet the criteria defined in 
section 7.2 of draft-ietf-abfab-gss-eap:

    In the top-level registry titled "Kerberos V GSS-API Mechanism
    Parameters", a subregistry called "Kerberos GSS-API Token Type
    Identifiers" was created; the references for this subregistry are RFC
    4121 and this document.  The allocation procedure is Expert Review
    [RFC5226].  The Expert's primary job is to make sure that token type
    identifiers are requested by an appropriate requester for the RFC
    4121 mechanism in which they will be used and that multiple values
    are not allocated for the same purpose.  For RFC 4121 and this
    mechanism, the Expert is currently expected to make allocations for
    token identifiers from documents in the IETF stream; effectively, for
    these mechanisms, the Expert currently confirms the allocation meets
    the requirements of the IETF Review process.

The RFC 4121 (krb5) and RFC 7055 (EAP) mechanisms appear to be 
specifically called out to have the expected behavior of the exper 
reviewer essentially be "standards action", to confirm that the assignment 
has had adequate IETF review.  Perhaps token types used by some other 
mechanism could get by with a weaker review standard.

To me, this seems like a(nother) bug in RFC 7055, but of course it is not 
one that can be reasonably fixed.  I guess that the easiest way forward is 
to publish a quick document that reserves 0405 and 0501 noting that they 
were in use before the registry was established.

-Ben