From K5Wiki
Revision as of 18:06, 3 January 2017 by TomYu (talk | contribs) (Current roadmap items: Trello is more up to date than JIRA)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

This is the outline of the development roadmap for MIT Kerberos. A more comprehensive list of projects is also available; some individual projects have links below.


Target 12 month cycle. (plus/minus 2 months)

Releases will have a 2-year maintenance lifetime, subject to changes based on community input.

Branch Jan. 2009
Release early Mar. 2010
Branch Oct. 2010
Release Dec. 2010
Branch Oct. 2011
Release Dec. 2011
Branch Oct. 2012
Release Dec. 2012
Branch Oct. 2013
Release Dec. 2013
Branch Aug. 2014
Release Oct. 2014
Branch Sep. 2015
Release Nov. 2015
Branch Aug. 2016
Release Oct. 2016

Guiding principles

  • Code quality
  • Developer experience (including modularity)
  • End-user experience
  • Administrator experience
  • Performance
  • Protocol evolution

Current roadmap items

This list will probably eventually be superseded by the Trello board (still migrating issues from the KRB JIRA backlog). Target releases for roadmap items are subject to change.



Long-term roadmap items

Code quality

  • Move toward test-driven development
  • Increase conformance to coding style
    • Selective refactoring
    • Continue formatting cleanup
  • Use cyclomatic complexity metrics to identify cleanup targets

Developer experience

  • Crypto modularity -- make sure PKCS#11 etc. work well
  • API documentation
  • Support readily building subsets
    • "Lite" client
    • "Lite" server
  • KDC Database modularity (long-term)
    • SQLite back end
    • Does the existing DAL make sense?
    • Make data model less "blobby"
    • Track IETF data model work
  • Plugin support improvements
    • GSS-API mechanism glue
    • DNS / host-to-realm mapping
  • Secure co-processor ("would be nice")
  • GSS proxy
  • interposition capability for GSS mechs (useful for GSS proxy) -- external for 1.11
  • Use default keytab for gss_init_sec_context
  • gss_export_cred (useful for async GSS proxy)
  • Improve ASN.1 support code (better support for plugins that need to encode/decode their own ASN.1 types)

End-user experience

  • Improve credential management

Administrator Experience

  • Plugin for kadmin authorizations
  • Move more realm-global configuration into KDB
  • Add interface to purge old keys (1.8 patch?)
  • Add interface to delete keys of specific enctypes (1.8 patch?)
  • Disable enctypes at compile time (1.8 patch?)
  • Improve IPv6 support
  • Improve key rollover
    • Application service keys
  • Decrease DNS-related fragility
  • Plugins for login failure lockout
  • Plugins for audit support
  • Plugins for ticket issuance access control
  • Plugins for domain-realm mapping
  • Friendlier smart card support
  • FAST OTP client in libkrb5 (maybe excluding second-level plugins hardware OTP tokens)
  • Multiple logging levels for trace logging


  • Decrease DNS traffic
  • Client resolution of KDC (etc.) addresses can be very slow. Decouple address resolution from initiation of KDC communications. (requires some redesign of internal interfaces)
  • Replay cache ("rcache")
    • Improve implementation
    • Support disabling by service type name
  • Enhancements to improve concurrency
    • Explicit state
    • Reduce mutex contention
    • Support asynchronous APIs and frameworks such as Apple's Grand Central Dispatch; begin refactoring code to make this easier

Protocol evolution

  • International strings in protocol (need IETF feedback)
    • Principal names
    • Error strings, etc. (need language tag negotiation)
  • Timestamp-independence
  • Replay-proofing protocols
  • Encryption algorithm updates (SHA-2, SHA-3, CCM, GCM)
  • PKU2U
  • One time password support
  • Multiply-authenticated authorization data container
  • POSIX IDs in authorization data
  • Level of Assurance in authorization data
  • Site-defined string-keyed claims in authorization data
  • X.509 attributes in authorization data
  • FAST preauth sets (e.g. OTP + long-term password)

Completed roadmap items

See Roadmap (completed items).