Subject: PKINIT issues

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 18 May 2004 20:25:41 -0400

When we originally talked about doing formal issue tracking for this 
working group, I expected that PKINIT would be completed rather quickly, 
and thus would not need to be included.  Well, that assumption was clearly 
incorrect, and I've already warned another prospective WG chair against 
making the same mistake. :-)

So instead, I'm making PKINIT the pilot for the new system.  This is partly 
to try to get the remaining issues resolved more quickly, and partly in 
direct response to complaints I've received privately from a couple of 
individuals about the open-issue list not being sufficiently accessible.

I'm including below my accumulated state so far on open issues.  It was 
last touched May 7, so does not include some things brought up since then. 
I'm fairly certain there are also some issues that Love brought up before 
that date which I haven't included in the list yet.

I'll be adding tickets for all of these items, plus those I find in 
reviewing the mailing list traffic.  To assist in this, I'd like to ask 
anyone who knows of issues not on this list to let me know what they are, 
so I can make sure not to omit them.  A detailed analysis is not required; 
just a one-line description or a reference to a message on the WG list 
should be sufficient.

For now, please continue to bring up new issues on the WG mailing list. 
Once I've finished setting things up in RT-land, perhaps we'll arrange for 
new tickets to be announced here automatically.

-- Jeff

---

From: Brian Tung <[email-masked]>
Date: Tue, 18 May 2004 21:45:44 -0700

Jeffrey Hutzelman wrote:
> I'm including below my accumulated state so far on open issues.

Did I miss it?  Was it supposed to be a list?

Brian Tung <[email-masked]>

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 19 May 2004 12:20:25 -0400

> Did I miss it?  Was it supposed to be a list?

My bad; I forgot to actually append the file...

MILESTONES:

NOV 21  - submit pkinit-17
JAN 12  - submit pkinit-18 with all updates above
MAR     - WG last call

OPEN ISSUES:
-- Update PA types [Cliff Neuman + editor; last]
-- ASN.1 errata - wrong module import for PKIX
-- ASN.1 errata - incorrect/multiple import statements
-- ASN.1 errata - subjectAltName definition
-- ASN.1 errata - wrong context tag in TrustedCas (0->1, 1->2)
   Dropping principalName[0] should not have renumbered other fields

-- ASN.1 module appendix
   - Eric Rosenfeld would like to see a complete module in an appendix

-- OCSP tunneling:
   - Microsoft's OCSP text included defining a tunneling mechanism for OCSP
     in PKINIT.  Eric Rosenfeld objects to including this in PKINIT; he
     suggests moving it to a separate draft.
   - Sam Hartman says it was his understanding that this was what we
     were expecting.  He asks what we lose by moving it into a separate
     draft, and whether we have people interested in handling it as a
     separate draft.

-- AD-INITIAL-VERIFIED-CAs
   - Nico provided text for an AD type to include CA's used in cert
     verification by the KDC.
   - Eric Rosenfeld objects to making this mandatory for PKINIT
   - Sam believes this needs to be mandatory, as it performs a function
     analgous to that of transited-realms, and is needed for the same
     reasons.

-- diffie-hellman open issues
   - Larry Zhu has volunteered to research this

-- comments on PA-PK-AS-REP (from lha)
-- KDC certificate issue (from lha)
-- enctype vs OID issue (from lha)

CLOSED ISSUES:
++ REMOVE use of raw public keys [editor]
++ REMOVE name transformation [editor]
++ REMOVE principal name as trusted-CA [editor]
++ Internationalization of strings [Jeff Altman]
++ Extensibility [Jeff Hutzelman]
++ Confirm alignment with CMS [Todd Stecher/Microsoft]
++ initial flag issue [initial flag SET for pkinit; confirmed on list]
++ transited CA's AUTH-DATA [bcn, Nico Williams]
++ OCSP and optional revocation information [JK]
++ Security of cached DH values and use of a nonce [JK]
++ Confirm alignment with kerberos-clarifications [Nico Williams]
++ How to transform DH shared secret into a key [Sasha Medvinsky]
++ Confirm alignment with kcrypto [Sasha Medvinsky]
++ client name canonicalization problems (from Nico)
xx refactoring preauth [Sam Hartman]
++ name canonicalization / cname optionality
   - MS requested "blank" name for use when requesting canonicalization
   - Sam Hartman - still an open issue whether this is allowed
   - Larry indicates MS is fine with moving this feature to referrals
++ specify subjectAltName for user cert [tlyu, jaltman, editor]