Subject: [nfsv4] 3530bis kerberos references

From: "J. Bruce Fields" <[email-masked]>
Date: Tue, 30 Aug 2011 11:03:16 -0400

3530bis says "Once a revision to [rfc 1964] is available that adds
support for AES, implementors are urged to incorporate AES into their
NFSv4 over Kerberos V5 protocol stacks".

I assume it's RFC 4121 ("The Kerberos Version 5 Generic Security Service
Application Program Interface (GSS-API) Mechanism: Version 2") that's
the referred-to revision, so the above text should be updated to refer
to that.

(Can we also update all the references to 1964 to references to 4121?  I
don't know if 4121 imposes new requirements that would make it out of
scope to require it for 3530bis?)

--b.

---

From: Spencer Shepler <[email-masked]>
Date: Tue, 30 Aug 2011 17:40:44 +0000

The Kerberos references should be updated to 4121.
The 4121 reference is used in 5661 so we are good
with respect to prior use.

As to the AES reference, I have not looked at the issue.

Spencer

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> J. Bruce Fields
> Sent: Tuesday, August 30, 2011 8:03 AM
> To: [email-masked]
> Cc: Nico Williams
> Subject: [nfsv4] 3530bis kerberos references
> 
> 3530bis says "Once a revision to [rfc 1964] is available that adds support
> for AES, implementors are urged to incorporate AES into their
> Application Program Interface (GSS-API) Mechanism: Version 2") that's the
> referred-to revision, so the above text should be updated to refer to
> that.
> 
> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nfsv4

---

From: "J. Bruce Fields" <[email-masked]>
Date: Tue, 30 Aug 2011 17:44:39 -0400

> As to the AES reference, I have not looked at the issue.

I think recommendations about strength of particular crypto algorithms
is really the job of the kerberos documents.  So now that they've been
updated we could probably just drop that particular sentence and assume
similar advice is incorporated by reference.

(For example, rfc 4120, referred to by 4121, says "the single DES
encryption algorithm o nwhich these are based is weak, and stronger
algorithms should be used whenever possible.")

So that'd be the following.

--b.

diff --git a/nfsv4_back_references.xml b/nfsv4_back_references.xml
index c75d1c1..ce5a6b9 100644
--- a/nfsv4_back_references.xml
+++ b/nfsv4_back_references.xml
@@ -644,17 +644,23 @@ document are to be interpreted as described in RFC
       target="ftp://ftp.isi.edu/in-notes/rfc4506.txt"/>
   </reference>
 
-    <reference anchor='RFC1964'>
+    <reference anchor='RFC4121'>
       <front>
-	<title>The Kerberos Version 5 GSS-API Mechanism</title>
-	<author initials="J." surname="Linn" fullname="J. Linn">
-	  <organization>OpenVision Technologies</organization>
+	<title>The Kerberos Version 5 Generic Security Service
+	  Application Program Interface (GSS-API) Mechanism: Version 2</title>
+	<author initials="L." surname="Zhu" fullname="L. Zhu">
+	  <organization>Microsoft</organization>
 	</author>
-	<date year="1996" month="June"/>
+	<author initials="K." surname="Jaganathan" fullname="K. Jaganathan">
+	  <organization>Microsoft</organization>
+	</author>
+	<author initials="S." surname="Hartman" fullname="S. Hartman">
+	  <organization>MIT</organization>
+	</author>
+	<date year="2005" month="July"/>
       </front>
-      <seriesInfo name="RFC" value="1964"/>
-      <format type="TXT" octets="600988" 
-	      target="ftp://ftp.isi.edu/in-notes/rfc1964.txt"/>
+      <seriesInfo name="RFC" value="4121"/>
+      <format type="TXT" target="http://www.ietf.org/rfc/rfc4121.txt"/>
     </reference>
 
     <reference anchor='RFC3010'>
diff --git a/nfsv4_middle_introduction.xml b/nfsv4_middle_introduction.xml
index f7135b9..6ed1310 100644
--- a/nfsv4_middle_introduction.xml
+++ b/nfsv4_middle_introduction.xml
@@ -245,7 +245,7 @@
         use of RPCSEC_GSS, various mechanisms can be provided to
         offer authentication, integrity, and privacy to the NFS
         version 4 protocol.  Kerberos V5 will be used as described
-        in <xref target="RFC1964" /> to provide one security
+        in <xref target="RFC4121" /> to provide one security
         framework.
         With the use of RPCSEC_GSS,
         other mechanisms may also be specified and used for NFS
diff --git a/nfsv4_middle_rpc_sec.xml b/nfsv4_middle_rpc_sec.xml
index 936644d..d20572f 100644
--- a/nfsv4_middle_rpc_sec.xml
+++ b/nfsv4_middle_rpc_sec.xml
@@ -141,7 +141,7 @@
       <section anchor="krb5:sectrip" title="Kerberos V5 as a security triple">
 
         <t>
-          The Kerberos V5 GSS-API mechanism as described in <xref target="RFC1964" /> MUST be
+          The Kerberos V5 GSS-API mechanism as described in <xref target="RFC4121" /> MUST be
           implemented and provide the following security triples.
         </t>
 
@@ -181,14 +181,6 @@
           <xref target="RFC2623" />.
         </t>
 
-        <t>
-          Users and implementors are warned that 56 bit DES is no longer
-          considered state of the art in terms of resistance to brute force
-          attacks.  Once a revision to <xref target="RFC1964" /> is available that adds support
-          for AES, implementors are urged to incorporate AES into their NFSv4
-          over Kerberos V5 protocol stacks, and users are similarly urged to
-          migrate to the use of AES.
-        </t>
       </section>
     </section>
   </section>

---

From: Spencer Shepler <[email-masked]>
Date: Tue, 30 Aug 2011 22:04:48 +0000

That approach is fine with me. Thanks for the suggestion.

Spencer

-----Original Message-----
From: J. Bruce Fields
Sent: Tuesday, August 30, 2011 2:46 PM
To: Spencer Shepler
Cc: [email-masked]; Nico Williams
Subject: Re: [nfsv4] 3530bis kerberos references

--b.

         <t>

@@ -181,14 +181,6 @@

-        <t>

---

From: "J. Bruce Fields" <[email-masked]>
Date: Wed, 31 Aug 2011 13:04:17 -0400

> That approach is fine with me. Thanks for the suggestion.

OK.  Tom, I added that to my git repo if you want to take it from there.

--b.