Re: [kitten] Windows Intent to revive and implement IAKerb draft-ietf-kitten-iakerb-03

[Jeffrey Altman <[e-mail]>]

It should also be noted that in 2019 it was determined that there was no 
longer any interest in further development of IAKerb and the Working 
Group State for the document was set to "Dead WG Document".   Although 
IAKerb was never removed from the Kitten Charter.

https://datatracker.ietf.org/wg/kitten/about/

Its unclear to me from a process perspective whether the charter 
document is simply out of date and IAKerb needs to be once again added 
as a working group work item OR whether the Dead WG Document state can 
be removed by publishing an update.

The initial individual draft was published in 2006.  At that time there 
was a very narrow use case which drove the effort.   Over time the range 
of use cases grew broader without being reflected in the text of the 
draft. Re-reading the draft today for first time in years I believe the 
draft fails to sufficiently describe the use cases for which it is 
intended and those which should be considered out of scope.

I am in favor of IAKerb or something like it being adopted and 
implemented.   I would appreciate it if Steve could describe the 2023 
use cases for which Microsoft intends to use it in case they have 
significantly diverged from those considered in 2006.

Jeffrey Altman

On 2/17/2023 8:31 AM, Jeffrey Altman ([e-mail]) wrote:
>
> Please note that draft 3 does not include all of the feedback provided 
> on draft 2.
>
> The draft 2 feedback starts with this archived message
>
> https://mailarchive.ietf.org/arch/msg/kitten/5l6CknOZBF39aZps7wQIsl_L-6o/
>
> and the diff between drafts 2 and 3 can be found here
>
> https://www.ietf.org/rfcdiff?url2=draft-ietf-kitten-iakerb-03
>
> The discussion around error handling and default realm determination 
> is particularly important in my opinion.
>
> I do not believe there are any implementations of draft 3.
>
> Jeffrey Altman
>
> On 2/16/2023 6:57 PM, Steve Syfuhs (AP) 
> (Steve.Syfuhs=[e-mail]) wrote:
>>
>> Howdy folks,
>>
>> I’m a developer on the Windows auth team that oversees Kerberos 
>> development. We were handed the torch from Larry, Michiko, and crew 
>> when they went off to do other exciting things.
>>
>> We’re currently in the process of implementing IAKerb as per the 
>> latest expired draft and want to revive it and see it through to full 
>> RFC. Happy to go into detail about why, but the benefits are I think 
>> fairly self explanatory.
>>
>> Unfortunately there’s a fair amount of institutional knowledge around 
>> this protocol that’s been lost to time and I was wondering if someone 
>> could provide background on where things were last? What is required 
>> in order to see it through?
>>
>> We have a few open questions, specifically around interop.
>>
>> What is the state of the MIT implementation? The draft refers to 
>> interop with earlier versions. Is this something we need to 
>> reasonably care about? The draft says the Finished checksum key usage 
>> is implemented as int 42, but specced as 41. Why wasn’t 42 used in 
>> the spec (that’s otherwise a rather obnoxious interop hack)?
>>
>> As mentioned, happy to go into more detail about our plans.
>>
>> Cheers
>>
>> Steve
>>
>>
>> _______________________________________________
>> Kitten mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/kitten
>
> _______________________________________________
> Kitten mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/kitten