Subject: [TLS] Interest in TLS authorization?

From: Eric Rescorla <[email-masked]>
Date: Tue, 17 Mar 2009 20:55:18 -0700

Hi folks,

As you may know, the IESG declined to advance
draft-housley-tls-authz as PS. However, during the
IETF Last Call, there were some expressions of interest
in work in this general area, for which the TLS WG
would be the appropriate venue.

The TLS WG is meeting at IETF 74 in San Francisco.
If there are people who want the TLS WG to take on
work in this area, this would be the appropriate time
to ask for agenda time to discuss it.

-Ekr

---

From: "Mardikar, Upendra" <[email-masked]>
Date: Tue, 17 Mar 2009 20:59:47 -0700

This would be of interest to us. I am in.
Upendra

-----Original Message-----
From: [email-masked] on behalf of Eric Rescorla
Sent: Tue 3/17/2009 8:55 PM
To: [email-masked]
Subject: [TLS] Interest in TLS authorization?
 
Hi folks,

-Ekr
_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Sean Shen <[email-masked]>
Date: Wed, 18 Mar 2009 13:30:35 +0800

I am interested in this.

Sean

>From: [email-masked] [mailto:[email-masked]] On 
>Behalf Of Mardikar, Upendra
>Sent: Wednesday, March 18, 2009 12:00 PM
>To: Eric Rescorla; [email-masked]
>Subject: Re: [TLS] Interest in TLS authorization?
>
>
>draft-housley-tls-authz as PS. However, during the IETF Last 
>Call, there were some expressions of interest in work in this 
>general area, for which the TLS WG would be the appropriate venue.
>
>If there are people who want the TLS WG to take on work in 
>this area, this would be the appropriate time to ask for 
>agenda time to discuss it.
>
>-Ekr

---

From: "Daniel Diaz Sanchez" <[email-masked]>
Date: Wed, 18 Mar 2009 09:03:18 +0100

I'm interested in this. Moreover, I've already done some works and
implementations. 

If anybody is interested I can send some articles with our proposals.

---
Daniel Díaz-Sanchez, Ph.D
Telecommunication Engineer

Dep. Ing. Telemática
Universidad Carlos III de Madrid
Av. Universidad, 30
28911 Leganés (Madrid/Spain)
Tel: (+34) 91-624-6233, Fax: -8749

Web: http://www.it.uc3m.es/dds
Web: http://www.it.uc3m.es/pervasive
A toolkit for attribute certificates (authz):
http://www.it.uc3m.es/dds/swRelease/pmi/pmi.xml

-----Mensaje original-----
De: [email-masked] [mailto:[email-masked]] En nombre de Sean
Shen
Enviado el: miércoles, 18 de marzo de 2009 6:31
Para: 'Mardikar, Upendra'; 'Eric Rescorla'; [email-masked]
Asunto: Re: [TLS] Interest in TLS authorization?

I am interested in this.

Sean

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 18 Mar 2009 09:43:51 +0100

> If anybody is interested I can send some articles with our proposals.

Hi!  Yes, please do.  I'm interested in reviewing and implementing this
as well.

Thanks,
/Simon

---

From: "ietf+hardjono.net" <[email-masked]>
Date: Wed, 18 Mar 2009 09:30:53 -0500

Hi Eric,

Yes I'm interested in this item. Any background as to why it was declined by
the IESG?

cheers,

/thomas/

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Eric Rescorla
> Sent: Tuesday, March 17, 2009 10:55 PM
> To: [email-masked]

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 24 Mar 2009 11:58:53 -0700

Discussing this topic at a meeting is pretty much a prerequisite
to deciding to work on it. A number of people followed up to say
they had interest in this topic, but I haven't had any requests for
agenda time as of yet. If there is someone in SFO who wants to
talk about this on Thursday, please e-mail me.

-Ekr

---

From: "Thomas Hardjono" <[email-masked]>
Date: Tue, 24 Mar 2009 16:28:13 -0500

Hi Eric,

I was one of the persons indicating interest in this work item. However, it
turns-out I will not be able to attend the TLS WG on Thu due to a clash. My
apologies.

cheers,

/thomas/

> Sent: Tuesday, March 24, 2009 1:59 PM
> To: [email-masked]

---

From: Dean Anderson <[email-masked]>
Date: Tue, 24 Mar 2009 18:59:48 -0400 (EDT)

Hi Folks,

I am interested in the topic of TLS authorization, but not in advancing
the patented Redphone proposal.  I am willing to work on non-patented
alternatives. I have read the patent and the prior art. I worked on OSF
DCE back in the 1990s at the OSF and as a consultant to other companies.  
DCE includes authorization facilities beyond those provided by Kerberos,
including public key auth* RPC. I've been working recently to revive the
DCE project, and I see TLS authorization as related work.

I would like to see an authorization framework created which is free of
patents, or least free of patents that aren't mutually-defensive. An
added benefit would be if that framework isn't too specific to TLS and
could be used by other protocols. Something like SASL comes to mind.  
Though I've never been very happy with SASL for authentication, the
concept of a generic authorization layer seems desirable.

Thanks,

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 24 Mar 2009 18:12:50 -0500

> concept of a generic authorization layer seems desirable.

KITTEN WG has a work item on extending GSS-API interfaces to expose
authorization information, e.g., DCE or WIndows PAC type data in
Kerberos V tickets, but not just those.  Think SAML in krb5 tix, PKIX
certs, ...

The SASL WG is working on GS2 -- a new GSS-API->SASL mechanism bridge so
you can use GSS-API mechanisms in SASL apps.

The only things missing then would be:

 - how to put SAML/whatever authorization elements into Kerberos V
   tickets and PKIX certificates

 - how to use SASL in TLS

The latter is a variant of "how to use the GSS-API inside TLS", and that
has been controversial and has never progressed within the TLS WG.  IIRC
the controversy arises from the fact that the GSS-API supports
arbitrary round trips, and the same is true of SASL -- so you're likely
to run into the same issue.

However, I think we might be able to do something about that: ride some
of the SASL/GSS-API messages in TLS handshake extensions and complete
the SASL/GSS-API authentication exchange after the TLS exchange
completes if the SASL/GSS-API mechanism requires further round-trips.
Such a protocol would only be usable by applications that support such a
protocol as that'd not be "TLS" -- but consider how many SASL apps run
over TLS.

A bit roundabout.  But I don't see how there could exist patents that
cover this, short of submarine patents by really clever people or
submarine patents filed by someone who overheard early discussions of
putting SAML into Kerberos some three or so years ago.

Nico
--

---

From: Bruno Harbulot <[email-masked]>
Date: Wed, 25 Mar 2009 14:14:06 +0000

Hello,

>    tickets and PKIX certificates

I'm not sure if you are aware of this work, but these links may be 
relevant (regarding SAML authorization elements in PKIX certificates):

- https://spaces.internet2.edu/display/GS/X509BindingSAML
- http://dev.globus.org/wiki/SAML_in_X.509_Validation

Best wishes,

Bruno.