Subject: [kitten] I-D Action: draft-ietf-krb-wg-cammac-05.txt

From: [email-masked]
Date: Sun, 14 Jul 2013 19:20:19 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Common Authentication Technology Next Generation Working Group of the IETF.

	Title           : Kerberos Authorization Data Container Authenticated by Multiple MACs
	Author(s)       : Simo Sorce
                          Tom Yu
                          Thomas Hardjono
	Filename        : draft-ietf-krb-wg-cammac-05.txt
	Pages           : 9
	Date            : 2013-07-14

Abstract:
   Abstract: This document specifies a Kerberos Authorization Data
   container that supersedes AD-KDC-ISSUED.  It allows for multiple
   Message Authentication Codes (MACs) or signatures to authenticate the
   contained Authorization Data elements.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-krb-wg-cammac

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-krb-wg-cammac-05

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-krb-wg-cammac-05

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 15 Jul 2013 17:54:29 -0400 (EDT)

> https://datatracker.ietf.org/doc/draft-ietf-krb-wg-cammac

I caught Tom and Simo on IRC, but should summarize to the list:

I think we should provide a little more guidance about what the 
AD_CAMMAC_BINDING element would contain (i.e., what it would be a checksum 
over).  Tom says we could give a "signed ticket" as an example, and Simo 
suggests that we could put something in the security considerations 
section, which is fine for me.  When an actual implementation is in place, 
we could put out an informational RFC with the format that is used, to aid 
interoperability.

-Ben