Subject: Re: [Ietf-krb-wg] Last Call: <draft-ietf-krb-wg-otp-preauth-18.txt> (OTP Pre-authentication) to Proposed Standard

From: Sam Hartman <[email-masked]>
Date: Mon, 15 Aug 2011 19:46:41 -0400

Hi.
Just around the time  that this document was sent to the IESG, a
discussion started surrounding the nonce text in this draft in the
Kerberos working group.
All the participants seemed to agree that the discussion was
non-blocking: if consensus on a change was not found before ietf last
call  ended, then the existing text would stand.
So, I did not ask our AD to block the draft.

However, the Kerberos working group did reach a consensus on new text.
We'd like to propose to the IETF that

The text in section 4.1 is changed from:
        
        This nonce string MUST be as long as the longest key length of
        the symmetric key types that the KDC supports and MUST be chosen
        randomly.

to

        This nonce string MUST contain a randomly chosen component at
        least as long as the armor key length.

The KDC can then compose a nonce out of a random component and a
timestamp.

This change has already reached consensus within the working group. If
there are no objections (especially including objections from our AD)
I'll ask the authors to make this change. If there are objections then
our AD will judge consensus as usual.

Sam hartman
Kerberos Co-chair

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 16 Aug 2011 00:54:53 +0100

Hi Sam,

No problem here. Seems sensible either way to me and a little
better with the new text if that's what the WG prefer. I'd say
make the change when processing any other IETF LC comments.

S.

On 16/08/11 00:46, Sam Hartman wrote:
> _______________________________________________
> ietf-krb-wg mailing list
> [email-masked]
> https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
>

---

From: Greg Hudson <[email-masked]>
Date: Mon, 15 Aug 2011 11:22:54 -0400

I have a last-call comment about the KDC-generated nonce used in 4-pass
mode.  I would like the text in section 3.2 changed from:

to:

This change was previously discussed in the working group and appears to
be non-controversial there; see
https://lists.anl.gov/pipermail/ietf-krb-wg/2011-August/009549.html and
replies by Sam, Gareth, and Henry.

A brief justification: this change will allow KDCs to encode a timestamp
into the nonce, allowing them to determine recentness of PA-OTP-REQUESTs
without using cookies.  A KDC can still use cookies or a replay cache to
ensure the non-replay of PA-OTP-REQUESTs if desired.  The client key
used to encrypt the nonce is always of the same enctype as the armor
key, so there is no need to refer to other key types supported by the
KDC.