Subject: RE: Love's issue #4; was: Re: PKINIT open issues

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 28 May 2004 13:12:02 -0700

Love wrote:
 > 4) what is encryptionCert

I do not know what is encryptionCert in pkinit-18/pkinit-19, but this is
rather straightforward in our definition

    encryption-cert         [4] IMPLICIT OCTET STRING OPTIONAL
                                -- If the client cert can't be used for
                                -- encryption. For example, this may
                                -- be a Diffie-Hellman cert

Sam Hartman wrote: 

> Provided that the people using this option are not Microsoft, I agree.
...			
> However I seem to recall that Microsoft does not use DH and the two
modes of operation are DH and this option.

Microsoft does not use this field in the existing releases, but would it
be helpful to keep it around?

Thanks,

Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Sam Hartman
Sent: Wednesday, May 19, 2004 1:46 PM
To: D. R. Evans
Cc: [email-masked]
Subject: Re: Love's issue #4; was: Re: PKINIT open issues

>>>>> "D" == D R Evans <[email-masked]> writes:

    D> I wish someone would step forward and explain definitively how
    D> this option is supposed work.

    D> Maybe we should give a two-day deadline: if we don't hear
    D> anything by the end of Thursday, the encryptionCert option goes
    D> away because we think it's broken! Anyone object to that????

Provided that the people using this option are not Microsoft, I agree.
Unfortunately the people following this from Microsoft's side all seem
to be on vacation or out of the country right now.

However I seem to recall that Microsoft does not use DH and the two
modes of operation are DH and this option.

---

From: Sam Hartman <[email-masked]>
Date: Fri, 28 May 2004 19:01:25 -0400

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    Liqiang(Larry)> Microsoft does not use this field in the existing
    Liqiang(Larry)> releases, but would it be helpful to keep it
    Liqiang(Larry)> around?

Then how do you know what cert to use to encrypt the key to?

It seems not very helpful to keep around if no one uses it and if we
believe it is a security hole if used.