Subject: RE: PKINIT status?

From: Medvinsky Alexander-MGI1174 <[email-masked]>
Date: Tue, 17 Feb 2004 12:48:33 -0800

Jeff,

I already provided the text for my action item ("Confirm alignment with kcrypto") to Brian and you will see the new text for DH key derivation in the v.18 of the PKINIT draft.  I believe that it aligns with the kcrypto draft - I sent out a summary of this approach to the WG reflector, didn't get any responses and so it is now in the new draft.

Sasha.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jeffrey Hutzelman
Sent: Tuesday, February 17, 2004 12:00 PM
To: Eric Rosenfeld; [email-masked]
Subject: Re: PKINIT status?

On Tuesday, February 17, 2004 12:06:21 -0700 Eric Rosenfeld 
<[email-masked]> wrote:

> Would one of the WG co-chairs please provide an update on PKINIT? We 
> have been waiting for updated text from the author for quite a while 
> now. While the author has indicated to me that he will be able to 
> submit an updated draft by the cutoff (yesterday, I think), there has 
> been no discussion on this reflector. Given the huge number of updates 
> going into the latest PKINIT draft, I'd appreciate a status update. I 
> think it will help everyone understand where PKINIT is, and what the 
> next steps are.

A full PKINIT status update is on the agenda for the upcoming IETF meeting, 
and will appear in the minutes and proceedings from that meeting.  I had 
hoped to wait until that time, to avoid doing this twice, but I can see 
that some people are anxious for some evidence that work has, in fact, been 
going on, so I'll provide a _brief_ update here...

As you know, we reviewed open issues for PKINIT at a side meeting in 
Minneapolis.  A summary of that discussion was presented at the WG meeting, 
and a complete list of open issues was posted to this list in mid-December, 
and again in early January.  Most of the items on that list required only 
that some appropriate person come up with text to address issues on which 
the working group had already reached concensus.  Most of those, in turn, 
were sent directly to the document editor without appearing separately on 
this list.  There's nothing wrong with that -- new decisions weren't made, 
and the working group will be expected to review the complete document.

An updated draft (pkinit-18) was sent to the IETF secretariat over the 
weekend.  It has appeared in the I-D repository and was announced on this 
list.  This update should address nearly all of the items that were listed 
on the open-issues list, plus a few other comments that were raised.  I 
encourage the working group to review this document in detail; unless there 
are significant unforeseen issues, this will probably be the next-to-last 
draft before we send the document to the IESG.

At the moment, I believe the following items are still open issues:

OPEN ISSUES:
?? refactoring preauth [Sam Hartman]
   Sam has indicated that he does not presently have any changes to be
   made to PKINIT to reflect the new preauth framework.  As previously
   agreed, PKINIT will not be held up for the new framework.  So unless
   work on the framework proceeds exceedingly quickly, or PKINIT is held
   up for some unforeseen problem, this item will not result in any
   changes the PKINIT document.

-- specify subjectAltName for user cert
   [tlyu, jaltman, editor; update at ietf58 meeting]
   This work is ongoing, but the details had not been hashed out in
   time for the I-D submission deadline.

-- Confirm alignment with kcrypto [Sasha Medvinsky]
   I've not heard anything specific from Sasha on this, aside from the
   discussion which occurred on this list regarding constructing keys
   from the result of a DH exchange.  It's important that this review
   be done, so that we can be sure PKINIT is using the crypto framework
   correctly.  However, this doesn't have to be an individual effort;
   the working group as a whole is responsible for this document, and
   anyone should feel free to comment on PKINIT-vs-kcrypto issues.

-- Update PA types [Cliff Neuman + editor; last]
   As indicated, this change is deliberately being held until late in
   the process.  As Brian and Cliff work just down the hall from each
   other, I'm sure there will be no problems getting numbers assigned
   for the next (hopefully final) draft.

-- Jeff