Roadmap

This is the outline of the development roadmap for MIT Kerberos. A more comprehensive list of projects is also available; some individual projects have links below.

Timeline

Target 12 month cycle. (plus/minus 2 months)

Releases will have a 2-year maintenance lifetime, subject to changes based on community input.

krb5-1.8

Branch Jan. 2009

Release early Mar. 2010

krb5-1.9

Branch Oct. 2010

Release Dec. 2010

krb5-1.10

Branch Oct. 2011

Release Dec. 2011

krb5-1.11

Branch Oct. 2012

Release Dec. 2012

krb5-1.12

Branch Oct. 2013

Release Dec. 2013

krb5-1.13

Branch Aug. 2014

Release Oct. 2014

krb5-1.14

Branch Sep. 2015

Release Nov. 2015

krb5-1.15

Branch Aug. 2016

Release Oct. 2016

Guiding principles

• Code quality
• Developer experience (including modularity)
• End-user experience
• Administrator experience
• Performance
• Protocol evolution

Current roadmap items

This list will probably eventually be superseded by the Trello board (still migrating issues from the KRB JIRA backlog). Target releases for roadmap items are subject to change.

krb5-1.15

• Projects/SPAKE_Preauthentication
• Projects/Reporting-friendly KDB dump format improvements
• URI discovery for KDC HTTP proxy
• Query to efficiently report when a principal is locked out due to password failures

krb5-1.16

• Forward secrecy for AP-REQ/AP-REP exchange
• Projects/Graceful_recovery_after_destructive_service_rekey

Long-term roadmap items

Code quality

• Move toward test-driven development
• Increase conformance to coding style
  • Selective refactoring
  • Continue formatting cleanup
• Use cyclomatic complexity metrics to identify cleanup targets

Developer experience

• Crypto modularity -- make sure PKCS#11 etc. work well
• API documentation
• Support readily building subsets
  • "Lite" client
  • "Lite" server
• KDC Database modularity (long-term)
  • SQLite back end
  • Does the existing DAL make sense?
  • Make data model less "blobby"
  • Track IETF data model work
• Plugin support improvements
  • GSS-API mechanism glue
  • DNS / host-to-realm mapping
• Secure co-processor ("would be nice")
• GSS proxy
• interposition capability for GSS mechs (useful for GSS proxy) -- external for 1.11
• Use default keytab for gss_init_sec_context
• gss_export_cred (useful for async GSS proxy)
• Improve ASN.1 support code (better support for plugins that need to encode/decode their own ASN.1 types)

End-user experience

• Improve credential management

Administrator Experience

• Plugin for kadmin authorizations
• Move more realm-global configuration into KDB
• Add interface to purge old keys (1.8 patch?)
• Add interface to delete keys of specific enctypes (1.8 patch?)
• Disable enctypes at compile time (1.8 patch?)
• Improve IPv6 support
• Improve key rollover
  • Application service keys
• Decrease DNS-related fragility
• Plugins for login failure lockout
• Plugins for audit support
• Plugins for ticket issuance access control
• Plugins for domain-realm mapping
• Friendlier smart card support
• FAST OTP client in libkrb5 (maybe excluding second-level plugins hardware OTP tokens)
• Multiple logging levels for trace logging

Performance

• Decrease DNS traffic
• Client resolution of KDC (etc.) addresses can be very slow. Decouple address resolution from initiation of KDC communications. (requires some redesign of internal interfaces)
• Replay cache ("rcache")
  • Improve implementation
  • Support disabling by service type name
• Enhancements to improve concurrency
  • Explicit state
  • Reduce mutex contention
  • Support asynchronous APIs and frameworks such as Apple's Grand Central Dispatch; begin refactoring code to make this easier

Protocol evolution

• International strings in protocol (need IETF feedback)
  • Principal names
  • Error strings, etc. (need language tag negotiation)
• Timestamp-independence
• Replay-proofing protocols
• Encryption algorithm updates (SHA-2, SHA-3, CCM, GCM)
• PKU2U
• One time password support
• Multiply-authenticated authorization data container
• POSIX IDs in authorization data
• Level of Assurance in authorization data
• Site-defined string-keyed claims in authorization data
• X.509 attributes in authorization data
• FAST preauth sets (e.g. OTP + long-term password)

Completed roadmap items

See Roadmap (completed items).