Subject: DNSEXT open WGLC (2001/10/30)

From: Ólafur Guðmundsson <[email-masked]>
Date: Tue, 30 Oct 2001 11:48:51 -0500

The last for iquery will conclude on Wednesday night.
	default action: is to advance if there are no further comments.

The last call for OK bit revision ends at the same time.
	default action: send back to RFC editor if no objections.

The last call for GSSAPI-TSIG will conclude on Wednesday next week,
send in comments.
	Default action: Chair has no sense at this time if this document
	is ready to be advanced, if there are no comments I think this
	document will be send up to IESG as "Experimental"  or "Informational".

	Olafur

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: "A. Gregory Rabil" <[email-masked]>
Date: Tue, 30 Oct 2001 12:28:29 -0500

Olafur,
Can you please explain why the GSSAPI-TSIG draft should not be advanced as a
standard?  What sort of comments do you require?

Regards,
Greg

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Olafur
> Gu?mundsson
> Sent: Tuesday, October 30, 2001 11:49 AM
> To: [email-masked]
> Subject: DNSEXT open WGLC (2001/10/30)
>
>

---

From: Ólafur Guðmundsson <[email-masked]>
Date: Tue, 30 Oct 2001 13:25:45 -0500

>standard?  What sort of comments do you require?

People saying this is important and it MUST be standardized, if noone
says so my read is that none cares thus we will publish as "informational"
and not bother with further standardization.

         Olafur

---

From: "A. Gregory Rabil" <[email-masked]>
Date: Tue, 30 Oct 2001 14:10:07 -0500

> and not bother with further standardization.

Okay, well I'd like to say that I believe it is important and should be
moved towards proposed standard.  I know of two implementations, Microsoft
and Lucent.  Also, I believe that the latest cut of ISC Bind 9 has a bit of
code dedicated to supporting GSSAPI-TSIG.  Therefore, I believe it is
important that these implementations adhere to a standard in order to
interoperate.

Greg

---

From: "David R. Conrad" <[email-masked]>
Date: Tue, 30 Oct 2001 11:44:50 -0800

Greg,

At 02:10 PM 10/30/2001 -0500, A. Gregory Rabil wrote:
>and Lucent.

An honest question:  how independent are those implementations?  I mean, is 
it necessary to use Microsoft DLLs or use a Microsoft KDC or whatever?

>Also, I believe that the latest cut of ISC Bind 9 has a bit of
>code dedicated to supporting GSSAPI-TSIG.

Well, yes, but there is no GSS-TSIG implementation in BINDv9.  There is a 
bit of code representing an early attempt but it is decidely non-functional.

Rgds,
-drc

---

From: Paul A Vixie <[email-masked]>
Date: Tue, 30 Oct 2001 11:43:06 -0800

> and not bother with further standardization.

i do not believe that gss-tsig is subject to standardization.  even a small
change at this point would upset a very large installed base, which would 
lead to an irrelevant standard.  let's just call this informational rather
than rubber-stamping a non-ietf-originated protocol with the ietf seal of
approval.

(an actual gss-based tsig standard would be implementable using other open
standards, so an argument along these lines would run very much like the
original rsa/dsa arguments in DNSSEC-land.)

---

From: Randy Bush <[email-masked]>
Date: Tue, 30 Oct 2001 12:25:00 -0800

[ i have yet to do sufficient homework to have a technical opinion, but
  think the process needs to be a bit more honest ]

> i do not believe that gss-tsig is subject to standardization.  even a

s/subject to standardization/advisable to modify/

> small change at this point would upset a very large installed base, which
> would lead to an irrelevant standard.  let's just call this informational
> rather than rubber-stamping a non-ietf-originated protocol with the ietf
> seal of approval.

what you seem to mean is that the ietf should rubber stamp it as an rfc and
not review the actual technology.

randy

---

From: Paul A Vixie <[email-masked]>
Date: Tue, 30 Oct 2001 12:56:30 -0800

> s/subject to standardization/advisable to modify/

standardize != publish.

> not review the actual technology.

same as with early imap, yes.  the rfc would be informational because it
would accurately describe a protocol developed outside of the ietf.  
editorial concerns such as "will interoperability be likely based on the
quality of the document" are relevant.  protocol standards concerns such
as "is this really the right way to do this?" are not (because it wasn't,
but arguing about it at this late date would be pointless.)

---

From: [email-masked] (Randy Hall)
Date: Tue, 30 Oct 2001 16:14:39 -0500

"David R. Conrad" wrote:
> >Okay, well I'd like to say that I believe it is important and 
> >should be moved towards proposed standard.  I know of two 
> >implementations, Microsoft
> >and Lucent.
> 
> An honest question:  how independent are those implementations?  I 
> mean, is it necessary to use Microsoft DLLs or use a Microsoft KDC 
> or whatever?

It is possible to implement the protocol without using Microsoft
DLLs, operating systems, or KDC.  Such an implementation
has been also been demonstrated to work using a Microsoft KDC
as well.

I believe it is possible for someone else to implement the 
protocol using open standards.  I believe such an implementation 
would interoperate with Lucent's implementation.  (I have not
actually verified that all of the open source components I
use are based on open standards, but I am fairly certain that 
they are).  

Cheers
Randy

---

From: "David R. Conrad" <[email-masked]>
Date: Tue, 30 Oct 2001 14:51:22 -0800

>has been also been demonstrated to work using a Microsoft KDC

If such is the case, then I would argue that it should be pushed forward as 
a standard as an alternative (optional) way to do TSIG.

Rgds,
-drc