Subject: chatroom log from our IETF#59 session

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 03 Mar 2004 14:25:38 +0900

Here is the jabber log from our IETF#59 session.
Thanks to Bob for scribing!

Kurt

[4:54 PM]<rlbob> i'll be scribing
[4:54 PM]<rlbob> session is now underway
[4:55 PM]<rlbob> sh:  2222bis is main item, also stringprep
[4:55 PM]<rlbob> sh:  all other documents have had revisions, but 2222bis is primary focus
[4:57 PM]<rlbob> sh:  specific individuals are being asked to review 2222bis
[4:57 PM]<hartmans> To clarify, there was some discussion on the list of saslprep, but I don't think any  changes were needed
[4:57 PM]<rlbob> kz:  need positive feedback that reviewers are happy with the doc
[4:57 PM]<rlbob> alexey now speaking about 2222bis issues
[4:58 PM]<rlbob> am:  suggested to use RFC 2828 for terminology, concern about possible conflicts
[4:59 PM]<rlbob> kz:  say "these terms are used as defined in 2828"
[4:59 PM]<rlbob> am:  need more generic description, not just list of documents to read
[5:00 PM]<rlbob> am:  thread on list about application of saslprep to authzid
[5:01 PM]<rlbob> am:  proposed text on list, didn't use "normalization" right, will give new text, will reflect agreement achieved on list
[5:01 PM]<rlbob> am:  big thread about what happens to layer on rengotiation if no new layer is requested [or something like that]
[5:02 PM]<rlbob> sh:  appears to be another example of chosen-ciphertext attack, already had discussion for digest-md5
[5:03 PM]<rlbob> sh:  will propose text for document ...
[5:06 PM]<rlbob> bob:  explains his note re importance of clarifying authz id
[5:07 PM]<hartmans> And dropping the concept of authentication ID
[5:08 PM]<rlbob> someone:  need to make distinction between them clear, easier if both are described and explained
[5:09 PM]<tonyhansen> (someone => Tony Hansen)
[5:10 PM]<rlbob> straw poll:  most people want to keep authn identity in the doc
[5:10 PM]<rlbob> kz:  discussion can continue, chairs will summarize next week
[5:13 PM]<hartmans> Bob Morgan: Concern about 2119 language applied to future specifications not to implementations
[5:14 PM]<hartmans> kz: Important that it be clear what the keywords refer to.
[5:14 PM]<rlbob> bob:  concern that 2119 MUST etc don't necessarily apply to constraints on authors, but don't have new language to offer
[5:14 PM]<rlbob> kz:  maybe problem is mixing different uses in the same doc, maybe can clarify per section
[5:14 PM]<hartmans> kz: Separate things so that requirements on specs are in different places than requirements on implementations
[5:14 PM]<hartmans> goal is that clear when reading the document.
[5:16 PM]<hartmans> kz: We still have more work to do on separation of requirements.  Then need to take a look at see if we will be confused.
[5:17 PM]<hartmans> am: Digest-md5
[5:17 PM]<rlbob> am:  moving on to digest-md5
[5:18 PM]<hartmans> am: Tried to clarify reauthentication, ABNF cleanup.
[5:19 PM]<rlbob> attempt to clarify saslprep issues, not finished yet
[5:19 PM]<rlbob> also attempt to clarify charset effects on realm, etc
[5:21 PM]<rlbob> cipher mode clarifications ...
[5:21 PM]<hartmans> am: Drop DES and 3DES per consensus.
[5:21 PM]<rlbob> reorganized confidentiality protection section
[5:21 PM]<rlbob> need lots of input on saslprep issues
[5:22 PM]<rlbob> also "what a realm should look like" question
[5:22 PM]<rlbob> still-open question:  need separate stringprep for realm?
[5:22 PM]<rlbob> kz:  good reason not to use saslprep?
[5:23 PM]<rlbob> am:  argument to made that realms should be same across digest, kerb, gss
[5:24 PM]<rlbob> sh:  gss has no realms, kerb realms are very complicated, so may not be able to be the same
[5:25 PM]<rlbob> am:  there is revision of http digest document, saying all username/passwords are UTF-8
[5:26 PM]<rlbob> am:  big hack in current http digest to use iso-8859-1 if possible, they're hoping to get rid of that ...
[5:27 PM]<hartmans> No the hack is in digest-md5 and was being considered for http-digest as I understand it.
[5:28 PM]<rlbob> sh:  let's take this issue to the list
[5:29 PM]<rlbob> am:  CBC attack
[5:30 PM]<rlbob> am:  two choices, explicit IV and ... sh will send comment to the list
[5:31 PM]<hartmans> second choice is a block type for explicit IV.
[5:31 PM]<rlbob> am:  document not ready for last call very soon
[5:32 PM]<rlbob> am:  also working on GSS document, posted in December
[5:33 PM]<rlbob> am:  example code removed, maybe should be added back
[5:35 PM]<rlbob> am:  should be able to get next rev of 2222bis shortly ...
[5:37 PM]<rlbob> kz:  looks like last on 2222bis may be in April, or even a little later
[5:38 PM]<rlbob> sh:  AD OK with May 04 for submission of 2222bis to IESG?
[5:38 PM]<rlbob> rh:  OK
[5:39 PM]<rlbob> sh:  reason gss doc looks simple is that gss community hasn't focused on it yet
[5:42 PM]<rlbob> kz:  chairs will post proposed new milestones to list by end of week
[5:43 PM]<rlbob> am:  working on C api
[5:43 PM]<rlbob> am:  also requested IETF last call on sasl-for-http document
[5:44 PM]<rlbob> jh:  has this been posted to sasl list?
[5:44 PM]<rlbob> am: yes
[5:45 PM]<rlbob> am:  sasl without persistent connection is "interesting"
[5:46 PM]<rlbob> bob:  intend to submit doc on SAML as SASL mechanism