Re: [Ietf-krb-wg] Rechartering

[Jeffrey Hutzelman <[e-mail]>]

Version 01 of the draft charter appears below.  This should address all
of the specific comments, additions, and corrections I have received.

Except for Nico, I haven't heard much from the working group on the
question of how broad a scope we want or how open-ended the charter
should be.  I would like to hear more on this topic.  I also wouldn't
mind hearing from an AD or three...

-- Jeff



Description of Working Group:

Kerberos over the years has been ported to virtually every operating
system.  There are at least two open source versions, with numerous
commercial versions based on these and other proprietary
implementations.
Kerberos evolution has continued in recent years, with the development
of new crypto and preauthentication frameworks, support for initial
authentication using public keys, improved support for protecting
clients' long-term keys during initial authentication, support for
anonymous and partially-anonymous authentication, and numerous
extensions developed in and out of the IETF.

However, wider deployment and advances in technology bring with them
both new challenges and new opportunities, such as exploring support
for new mechanisms for initial authentication, new cryptographic
technologies, and better integration of Kerberos with other systems
for authentication, authorization, and identity management.
In addition, several key features remain undefined.

The Kerberos Working Group will continue to improve the core Kerberos
specification, develop extensions to address new needs and technologies
related to the areas described above, and produce specifications for
missing functionality.


Specifically, the Working Group will:

* Complete existing work, including:
   - DHCP Option
(draft-sakane-dhc-dhcpv6-kdc-option-10.txt)
   - KDC Data Model            (draft-ietf-krb-wg-kdc-model-09.txt)
   - One-Time Passwords        (draft-ietf-krb-wg-otp-preauth-16.txt)
   - IAKERB                    (draft-ietf-krb-wg-iakerb-02.txt)
   - Single-DES Deprecation    (draft-lha-des-die-die-die-05.txt)

   - Hash agility for GSS-KRB5
(draft-ietf-krb-wg-gss-cb-hash-agility-06.txt)
   - Hash agility for PKINIT
(draft-ietf-krb-wg-pkinit-alg-agility-05.txt)
   - Referrals
(draft-ietf-krb-wg-kerberos-referrals-12.txt)
   - Set/Change Password
(draft-ietf-krb-wg-kerberos-set-passwd-08.txt)

* Prepare and advance one or more standards-track specifications which
  update the Kerberos version 5 protocol in a backward-compatible way
  to support non-ASCII principal and realm names, salt strings, and
  passwords, and localized error reporting.
  
* Prepare and advance one or more standards-track specifications which
  update the Kerberos version 5 protocol in a backward-compatible way
  to enable future protocol revisions and extensions.

* Prepare, review, and advance standards-track and informational
  specifications defining use of new cryptographic algorithms in the
  Kerberos protocol, on an ongoing basis.

* Prepare, review, and advance standards-track and informational
  specifications defining new authorization data types for carrying
  supplemental information about the client to which a Kerberos
  ticket has been issued and/or restrictions on what the ticket can
  be used for.

* Prepare a standards-track protocol to solve the use cases addressed
  by draft-hotz-kx509-01 including new support for digital signatures.

* Prepare and advance one or more standards-track specifications
  which define mechanisms for establishing keys and configuration
  information used during authentication between Kerberos realms.
  
* Prepare and advance a standards-track specification defining a
  format for the transport of Kerberos credentials within other
  protocols.

* Produce an LDAP schema for management of the KDC's database.


_______________________________________________
ietf-krb-wg mailing list
[e-mail]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg