Subject: Short summary, CAT-WG Minneapolis meeting

From: "Linn, John" <[email-masked]>
Date: Wed, 17 Mar 1999 09:16:12 -0500

Short summary (full minutes to follow separately), reported by John Linn
(RSA Laboratories).

The CAT-WG met for one 2.25 hour session at the Minneapolis IETF, with 114
attendees.
Regarding document actions, it was reported that the GSS-V2 and C bindings
drafts have been forwarded to the IESG, with a request that they be
considered for Proposed Standard status.

Regarding Kerberos-PKINIT, current draft changes and pending issues were
reviewed and discussed. Among other points, a follow-up draft is to adopt
use of CMS constructs to define the request from client to KDC as well as
the KDC's response, and means for accomodating key usage fields in
certificates are to be considered. Various changes and issues were also
discussed regarding Kerberos-Revisions (RFC-1510 successor); a summary of
issues and current proposals is to be sent to the WG list during the IETF
week as a basis for resolution and preparation of a follow-up draft. It was
recommended that ciphersuite constructs be incorporated; this also affects
the Kerberos GSS mechanism-2 document. Brief status information was
presented on the GAA-API activity; revised drafts are planned for the Oslo
IETF reflecting ongoing experience in application of GAA constructs.  

Extended discussion took place on the GSS Java bindings. The conclusion, to
be reflected in a revised draft, was to incorporate a factory approach with
Java interfaces for flexibility, but to provide a simple-to-use shim which
would instantiate classes corresponding to those interfaces.  A
separately-defined service provider layer, with definition to be pursued
simultaneously or later, could allow concurrent use of coexisting GSS
implementations by an application; absent that layer, an application could
use CLASSPATHs to select one implementation for its use. 

Extended discussion also took place on the topic of low-infrastructure GSS
mechanisms. Concern was expressed as to possible duplication with SASL-level
mechanisms, and a draft concerning GSS integration under SASL is to be
presented to the CAT-WG.  Two mechanism proposals were discussed.  The
GSS-Easy mechanism requires no public-key infrastructure, and performs
password-derived exchanges using one-way functions (OWFs).  Its OWF usage
for confidentiality was controversial; clear group sentiment favored use of
more conventional cryptographic constructs. Use of direct octet encoding was
preferred to ASN.1 representation.  The LIPKEY mechanism adapts SPKM for an
environment where servers are registered with public-key certificates, but
where client users authenticate with passwords. Significant group interest
was apparent in standardization of low-infrastructure mechanisms under the
GSS framework.  An informal straw poll suggested greatest interest in a
LIPKEY-based approach, followed (at about equal levels) by GSS-Easy and
potential proposals based on digest authentication.

--jl
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]