Difference between revisions of "Roadmap"
From K5Wiki
Line 51: | Line 51: | ||
* Increase conformance to coding style |
* Increase conformance to coding style |
||
** Selective refactoring |
** Selective refactoring |
||
− | *** KDC (1.9) |
||
** Continue formatting cleanup |
** Continue formatting cleanup |
||
* Use cyclomatic complexity metrics to identify cleanup targets |
* Use cyclomatic complexity metrics to identify cleanup targets |
||
Line 58: | Line 57: | ||
* Crypto modularity -- make sure PKCS#11 etc. work well |
* Crypto modularity -- make sure PKCS#11 etc. work well |
||
− | ** NSS back end (1.9) |
||
* API documentation |
* API documentation |
||
* Support readily building subsets |
* Support readily building subsets |
||
Line 80: | Line 78: | ||
=== End-user experience === |
=== End-user experience === |
||
− | * |
+ | * Improve credential management |
− | ** KIM API (done) |
||
− | ** Cross-platform CCAPI |
||
− | *** Done for Mac & Windows |
||
− | *** UNIX implementation |
||
=== Administrator Experience === |
=== Administrator Experience === |
||
Line 104: | Line 102: | ||
* Client resolution of KDC (etc.) addresses can be very slow. Decouple address resolution from initiation of KDC communications. (requires some redesign of internal interfaces) |
* Client resolution of KDC (etc.) addresses can be very slow. Decouple address resolution from initiation of KDC communications. (requires some redesign of internal interfaces) |
||
* Replay cache ("rcache") |
* Replay cache ("rcache") |
||
− | ** Disable on KDC |
||
− | *** Avoids known false-positive issues |
||
** Improve implementation |
** Improve implementation |
||
** Support disabling by service type name |
** Support disabling by service type name |
Revision as of 15:21, 31 August 2015
This is the outline of the development roadmap for MIT Kerberos. A more comprehensive list of projects is also available; some individual projects have links below.
Contents
Timeline
Target 12 month cycle. (plus/minus 2 months)
Releases will have a 2-year maintenance lifetime, subject to changes based on sponsor or community input.
- krb5-1.8
- Branch Jan. 2009
- Release early Mar. 2010
- krb5-1.9
- Branch Oct. 2010
- Release Dec. 2010
- krb5-1.10
- Branch Oct. 2011
- Release Dec. 2011
- krb5-1.11
- Branch Oct. 2012
- Release Dec. 2012
- krb5-1.12
- Branch Oct. 2013
- Release Dec. 2013
- krb5-1.13
- Branch Aug. 2014
- Release Oct. 2014
- krb5-1.14
- Branch Aug. 2015
- Release Oct. 2015
Guiding principles
- Code quality
- Developer experience (including modularity)
- End-user experience
- Administrator experience
- Performance
- Protocol evolution
Current roadmap items
Code quality
- Move toward test-driven development
- Increase conformance to coding style
- Selective refactoring
- Continue formatting cleanup
- Use cyclomatic complexity metrics to identify cleanup targets
Developer experience
- Crypto modularity -- make sure PKCS#11 etc. work well
- API documentation
- Support readily building subsets
- "Lite" client
- "Lite" server
- KDC Database modularity (long-term)
- SQLite back end
- Does the existing DAL make sense?
- Make data model less "blobby"
- Track IETF data model work
- Plugin support improvements
- GSS-API mechanism glue
- DNS / host-to-realm mapping
- Secure co-processor ("would be nice")
- GSS proxy
- interposition capability for GSS mechs (useful for GSS proxy) -- external for 1.11
- Use default keytab for gss_init_sec_context
- gss_export_cred (useful for async GSS proxy)
- Improve ASN.1 support code (better support for plugins that need to encode/decode their own ASN.1 types)
End-user experience
- Improve credential management
Administrator Experience
- Add interface to purge old keys (1.8 patch?)
- Add interface to delete keys of specific enctypes (1.8 patch?)
- Disable enctypes at compile time (1.8 patch?)
- Improve IPv6 support
- Improve key rollover
- Application service keys
- Decrease DNS-related fragility
- Plugins for login failure lockout
- Plugins for audit support
- Plugins for ticket issuance access control
- Plugins for domain-realm mapping
- Friendlier smart card support
- FAST OTP client in libkrb5 (maybe excluding second-level plugins hardware OTP tokens)
- Multiple logging levels for trace logging
Performance
- Decrease DNS traffic
- Client resolution of KDC (etc.) addresses can be very slow. Decouple address resolution from initiation of KDC communications. (requires some redesign of internal interfaces)
- Replay cache ("rcache")
- Improve implementation
- Support disabling by service type name
- Enhancements to improve concurrency
- Explicit state
- Reduce mutex contention
- Support asynchronous APIs and frameworks such as Apple's Grand Central Dispatch; begin refactoring code to make this easier
Protocol evolution
- International strings in protocol (need IETF feedback)
- Principal names
- Error strings, etc. (need language tag negotiation)
- Timestamp-independence
- Replay-proofing protocols
- Encryption algorithm updates (SHA-2, SHA-3, CCM, GCM)
- PKU2U
- One time password support
- Multiply-authenticated authorization data container
- POSIX IDs in authorization data
- Level of Assurance in authorization data
- Site-defined string-keyed claims in authorization data
- X.509 attributes in authorization data
- FAST preauth sets (e.g. OTP + long-term password)