Subject: [Fwd: Re: Kerb WG iakerb and change/set password Internet drafts]

From: "Douglas E. Engert" <[email-masked]>
Date: Tue, 12 Feb 2002 10:05:20 -0600

-------- Original Message --------
Subject: Re: Kerb WG iakerb and change/set password Internet drafts
Date: Tue, 12 Feb 2002 00:55:44 -0500
From: "Jeffrey I. Schiller" <[email-masked]>
To: "Douglas E. Engert" <[email-masked]>
CC: Jonathan Trostle <[email-masked]>
References: <001f01c1b2bd$467e7420$01e8a8c0@host3sy2bx4q> <[email-masked]>

Ok. I finally figured out what happened and why IAKERB and Set/Change
Password got stuck. The long and short of it is that IETF Last Calls
were never sent, but the documents were entered into the tracking
system, and then dropped (the tracking system was undergoing revision
at the time). Until today I had thought they had gone through IETF
last call and that all I had to do is the ballot, but that doesn't
appear to be the case.

I have submitted formal requests for last calls for both documents. I
have also submitted my formal ballot for Set/Change, so all that has
to happen now is the IESG needs to approve the Set/Change document,
which it can do at its telechat on March 7th assuming no issues arise
during last call.

As for IAKERB, I am concerned about Martin Rex's message. Doug: Do you
believe you have consensus, given Martin's objections? If Martin
raises a concern during IETF Wide Last Call, I need to prepare a
formal response. We'll see what happens (Jonathan: Want to Help? [I
have your previous response already]). Assuming nothing that we cannot
handle, it too can be finished at the March 7th telechat.

                        -Jeff

---

From: Martin Rex <[email-masked]>
Date: Wed, 13 Feb 2002 12:19:25 +0100 (MET)

I am still extremely concerned about the IAKERB proposal.

I still strongly object to how IAKERB is encapsulated with GSS-API
requires the bloated SPNEGO with no added value (and seriously
underspecified SPNEGO negotiation details) instead of running
the negotiation completely inside (as far as apps above
GSS-API are concerned) of the Kerberos GSS-API mechanism.
(take the details from my last Emails on this issue).

I don't have a good feeling about the actual underlying Kerberos message
exchange is technically sound, but I don't have the necessary Kerberos
background and experience to comment on that or come up with alternative
proposals (and therefore will not object to these details).
I really would appreciate if at least one of the Kerberos(&GSS-API)
gurus (like Ted Ts'o or John Linn) would take a detailed look
at the IAKERB proposal...

-Martin