Release Meeting Minutes/2014-10-21

Will Fiveash, Thomas Hardjono, Greg Hudson, Ben Kaduk, Simo Sorce, Tom Yu

GSS-python

Some discussion about how to handle failure conditions in accept_sec_context that have an error token as output. Exception or error code? Greg doesn't like having two different code paths for dealing with sending output tokens. Tom suggests to check the Java bindings for comparison.

Forward secrecy

Agility? Should we make the AP-REQ protocol multiple round trips? There are concerns with compatibility with existing applications and protocols. Maybe we can make the multiple round trip extension for GSS only? That might also have problems.

How do we configure fallbacks? Opportunistic DH public value sent first by client? Maybe this is too wasteful in some deployments where most of the servers don't support forward secrecy.

Tom would like to promote a design principle to make the defaults produce the most secure configuration reasonably possible in a completely new deployment. There are of course issues with compatibility in existing deployments. Maybe we can resolve some of these by sufficient communication well in advance.

Release

Next release is krb5-1.14, Oct. 2015. We should communicate contribution, etc. deadlines well before... maybe in November this year. Also add this info to roadmap page.