IETF Logo Mail Archive

Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges

Nicolas Williams <Nicolas.Williams@sun.com> Wed, 24 August 2005 21:32 UTC

Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1E82qz-00024d-13; Wed, 24 Aug 2005 17:32:13 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1E82qu-00021J-U8 for secmech@megatron.ietf.org; Wed, 24 Aug 2005 17:32:10 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA22794 for <secmech@ietf.org>; Wed, 24 Aug 2005 17:32:06 -0400 (EDT)
Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1E82rF-0000nR-Je for secmech@ietf.org; Wed, 24 Aug 2005 17:32:33 -0400
Received: from centralmail1brm.Central.Sun.COM (centralmail1brm.central.sun.com [129.147.62.1]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id j7OLW4TW007751 for <secmech@ietf.org>; Wed, 24 Aug 2005 15:32:04 -0600 (MDT)
Received: from binky.Central.Sun.COM (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id j7OLW3fa019449 for <secmech@ietf.org>; Wed, 24 Aug 2005 15:32:03 -0600 (MDT)
Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.13.3+Sun/8.13.3) with ESMTP id j7OLUE4d010636; Wed, 24 Aug 2005 16:30:14 -0500 (CDT)
Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.13.3+Sun/8.13.3/Submit) id j7OLUBH4010635; Wed, 24 Aug 2005 16:30:11 -0500 (CDT)
Date: Wed, 24 Aug 2005 16:30:11 -0500
From: Nicolas Williams <Nicolas.Williams@sun.com>
To: Bernard Aboba <aboba@internaut.com>
Subject: Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges
Message-ID: <20050824213010.GO10174@binky.Central.Sun.COM>
References: <43074F76.8000604@cs.umd.edu> <20050822044255.GC27685@isc.upenn.edu> <Pine.GSO.4.60.0508220801430.1114@ismene> <35850EE42DFD2824F0DDBBC8@cumulus> <Pine.GSO.4.60.0508221008260.1174@ismene> <1DCACCAC04655B3AFE9733A8@cumulus> <Pine.GSO.4.60.0508221047001.1307@ismene> <20050822154044.GE7789@binky.Central.Sun.COM> <430CA545.3020109@uni-tuebingen.de> <Pine.LNX.4.61.0508241113420.16086@internaut.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <Pine.LNX.4.61.0508241113420.16086@internaut.com>
User-Agent: Mutt/1.5.7i
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a
Cc: secmech@ietf.org
X-BeenThere: secmech@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Security mechanisms BOF <secmech.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/secmech>, <mailto:secmech-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/secmech>
List-Post: <mailto:secmech@lists.ietf.org>
List-Help: <mailto:secmech-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/secmech>, <mailto:secmech-request@lists.ietf.org?subject=subscribe>
Sender: secmech-bounces@lists.ietf.org
Errors-To: secmech-bounces@lists.ietf.org

On Wed, Aug 24, 2005 at 11:59:41AM -0700, Bernard Aboba wrote:
> We stopped work on the document because:
> 
> a) Kerberos did not meet the security criteria of RFC 4017 without PKINIT.

Does tunnelling various other weak mechanisms over TLS meet said
criteria?

> b) IEEE 802.11i did not want to require use of certificates. 

Certificates != PKI, PKINIT does not require a PKI.

> c) The CAT WG refused to advance IAKERB even after it had been included as 
>    an implementation requirement within IEEE 802.11i and had been 
>    implemented by at least one vendor.  This made it impossible for
>    IEEE 802.l1i to satisfy its IETF dependencies since EAP-GSS depended
>    on IAKERB. 

CAT WG closed years ago...

> d) GSSAPI did not include a PRF function, which made it difficult to 
>    generate an MSK/EMSK with the properties required by RFC 3748. 

That's almost fixed.

Nico
-- 

_______________________________________________
SECMECH mailing list
SECMECH@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/secmech

v2.23.0 | Report a Bug | By Email