IETF 82 Proceedings

Introduction  |  Area, Working Goup & BoF Reports  |  Plenaries  |  Training  |  Internet Research Task Force

Common Authentication Technology Next Generation (kitten) (WG)

Minutes  | Audio Archives  |  Jabber Logs  |  Mailing List Archives

Additional information is available at tools.ietf.org/wg/kitten

Chair(s): Alexey Melnikov Tom Yu Shawn Emery Security Area Director(s): Stephen Farrell Sean Turner Security Area Advisor: Stephen Farrell

Meeting Slides

• WG Status
• SASL-OAuth Changes
• naming-ext Issues
• OpenID Changes

Internet-Drafts:

• GSS-API Naming Extensions (37178 bytes)
• A SASL & GSS-API Mechanism for OpenID (40260 bytes)
• A SASL and GSS-API Mechanism for SAML (48889 bytes)
• SAML Enhanced Client SASL and GSS-API Mechanisms (46198 bytes)
• A SASL and GSS-API Mechanism for OAuth (46542 bytes)

Request for Comments:

• The Simple and Protected Generic Security ServiceApplication Program Interface (GSS-API) Negotiation Mechanism (RFC 4178) (46485 bytes) obsoletes RFC 2478
• A Pseudo-Random Function (PRF) API Extension for the Generic Security Service Application Program Interface (GSS-API) (RFC 4401) (15272 bytes)
• A Pseudo-Random Function (PRF) for the Kerberos V Generic Security Service Application Program Interface (GSS-API) Mechanism (RFC 4402) (9549 bytes)
• Desired Enhancements to Generic Security Services Application Program Interface (GSS-API) Version 3 Naming (RFC 4768) (27205 bytes)
• Generic Security Service Application Program Interface (GSS-API) Internationalization and Domain-Based Service Names and Name Type (RFC 5178) (17262 bytes)
• Generic Security Service Application Program Interface (GSS-API) Domain-Based Service Names Mapping for the Kerberos V GSS Mechanism (RFC 5179) (8017 bytes)
• Clarifications and Extensions to the Generic Security Service Application Program Interface (GSS-API) for the Use of Channel Bindings (RFC 5554) (8173 bytes) Updates RFC 2473
• Generic Security Service Application Program Interface (GSS-API) Extension for Storing Delegated Credentials (RFC 5588) (12434 bytes)
• Extended Generic Security Service Mechanism Inquiry APIs (RFC 5587) (32002 bytes)
• Generic Security Service API Version 2: Java Bindings Update (RFC 5653) (209903 bytes) obsoletes RFC 2853
• Moving DIGEST-MD5 to Historic (RFC 6331) (14047 bytes) obsoletes RFC 2831

Charter (as of 2011-12-09)

The Generic Security Services (GSS) API and Simple Authentication and
Security Layer (SASL) provide various applications with a security
framework for secure network communication. The purpose of the Common
Authentication Technology Next Generation (Kitten) working group (WG) is
to develop extensions/improvements to the GSS-API, shepherd specific
GSS-API security mechanisms, and provide guidance for any new SASL-
related submissions.

This working is chartered to specify the following extensions and
improvements (draft-yu-kitten-api-wishlist-00) to the GSS-API:

* Provide new interfaces for credential management, which include the
following:
initializing credentials
iterating credentials
exporting/importing credentials

* Specify interface for asynchronous calls.

* Negotiable replay cache avoidance

* Define interfaces for better error message reporting.

* Provide a more programmer friendly GSS-API for application developers.
This could include reducing the number of interface parameters, for
example, by eliminating parameters which are commonly used with the
default values.

* Specify an option for exporting partially-established security
contexts and possibly a utility function for exporting security
contexts in an encrypted form, as well as a corresponding utility
function to decrypt and import such security context tokens.

This WG is also chartered to finalize proposed SASL mechanisms as
GSS-API mechanisms (based on RFC 5801):

* A SASL Mechanism for OpenID

draft-ietf-kitten-sasl-openid


* SASL Mechanisms for SAML:

draft-ietf-kitten-sasl-saml
draft-cantor-ietf-kitten-saml-ec

The SAML mechanism drafts will include applicability
statement text to highlight when each is appropriate
for use.

* A SASL Mechanism for OAuth

draft-mills-kitten-sasl-oauth

The transition from SASL to GSS-API mechanisms will allow a greater set
of applications to utilize said mechanisms with SASL implementations
that support the use of GSS-API mechanisms in SASL (RFC 5801).

This WG should review proposals for new SASL and GSS-API mechanisms, but
may take on work on such mechanisms only through a revision of this
charter. The WG should also review non-mechanism proposals related to
SASL and the GSS-API. However, work that adds SASL or GSS-API support in
application protocols is out of scope and should be handled by the
corresponding application's WG.

Deliverables:

* GSS-API: initializing credentials

* GSS-API: iterating credentials

* GSS-API: exporting/importing credentials

* GSS-API: specification for asynchronous calls

* GSS-API: interfaces/improvements for better error message reporting

* GSS-API: programmer friendly interfaces

* SASL: SASL mechanism for OpenID

* SASL: SASL mechanisms for SAML

* SASL: SASL mechanism for OAuth

* GSS-API: publish draft-ietf-kitten-gssapi-extensions-iana

Goals and Milestones:

Jul 2011		Submit SASL OpenID mechanism to the IESG as Proposed Standard
Jul 2011		Submit naming-exts to the IESG as Proposed Standard
Jul 2011		WGLC on gssapi-extensions-iana
Aug 2011		Submit SASL SAML mechanisms to the IESG as Proposed Standard
Sep 2011		Submit gssapi-extensions-iana to the IESG as Proposed Standard