[SPKM] DTLS and GSS-API

Monday morning at IETF 67 there is a really important BOF: SPKM.

The purpose of this BOF is to decide how we will get a standards track
solution for NFSV4 to use PKI credentials.  Two modes are important: a
mode where both parties have credentials and a mode where the server
has a certificate and the client has a password.

The current proposal is based off draft-adamson-rfc2847-01.txt.
Several reviewers including Eric Rescorla and myself have expressed
concerns about this draft.

An alternate proposal for solving this problem was discussed in the
past: construct a GSS-API mechanism based on DTLS.  Advantages of this
solution include reuse of code and specification between GSS-API and
TLS implementations.  When new ciphers are specified for TLS they
would be available for NFS.  We would not need to keep updating a GSS
mechanism as public-key algorithms evolve and problems are found.

There are two main drawbacks I've heard to the DTLS proposal.  First,
we don't have a draft.  Second, it would not be interoperable with
SPKM-3 deployments.

I hope the BOF will answer the question of how much we care about
SPKM-3 deployments.

I only want to see one standards track solution in this space.
Currently, there does not seem to be enough interest in the DTLS
proposal for it to be a viable alternative.  I would like to encourage
the TLS community to take a look at draft-adamson-rfc2847-01 and to
consider how a DTLS approach would work and think about whether
advocating for such an approach would be a good idea.  If so, someone
at least needs to be prepared to give a brief presentation by next
Monday on such a proposal.

The BOF chair wanted to hear about anyone giving an alternative
presentation by Wednesday of this week.  I'm hoping he will be a bit
flexible as I was supposed to write this message last Friday.

Thanks for your consideration,

--Sam

_______________________________________________
SPKM mailing list
SPKM@ietf.org
https://www1.ietf.org/mailman/listinfo/spkm