Subject: PKINIT: PA-PK-AS-REP and encrypting the reply key

From: Doug Mitchell <[email-masked]>
Date: Wed, 19 May 2004 08:43:27 -0700

Hello,

I was referred to this email address by Sam Hartman of MIT. I'm a bit 
confused by some of the text of the PKINIT draft 
(draft-ietf-cat-kerberos-pk-init-19.txt, expires September 30, 2004).

The Draft defines the PA-PK-AS-REP like so:

	PA-PK-AS-REP ::= CHOICE {
         dhSignedData            [0] ContentInfo,
                                     -- Type is SignedData.
                                     -- Content is KDCDHKeyInfo
                                     -- (defined below).
         encKeyPack              [1] ContentInfo,
                                     -- Type is SignedData.
                                     -- Content is ReplyKeyPack
                                     -- (defined below).
         ...
     }

Then goes on to define ReplyKeyPack like so:

    If the KDC and client are not using Diffie-Hellman, the KDC encrypts
    the reply with an encryption key, packed in the encKeyPack, which
    contains data of type ReplyKeyPack:

     ReplyKeyPack ::= SEQUENCE {
         replyKey                [0] EncryptionKey,
                                     -- Defined in RFC 1510bis.
                                     -- Used to encrypt main reply.
                                     -- MUST be at least as strong
                                     -- as session key.  (Using the
                                     -- same enctype and a strong
                                     -- prng should suffice, if no
                                     -- stronger encryption system
                                     -- is available.)
         nonce                   [1] INTEGER,
                                     -- Binds reply to request.
                                     -- MUST be 0 < nonce < 2^32.
         ...
     }

I don't see how the reply key gets encrypted, unless the comment for 
PA-PK-AS-REP.encKeyPack is in error in saying the ContentType is 
SignedData. I'd think the ContentType there should be EncryptedData or 
EnvelopedData. In either case I think the discussion of the 
ReplyKeyPack (starting with "The fields of the ContentInfo for 
encKeyPack MUST be filled in as follows:") needs to be fleshed out 
considerably because there are (apparently) two kinds of ContentInfos 
involved here and the discussion switches back and forth between them 
(talking about both SignedData and encryptedContentType...).

If the content type for PA-PK-AS-REP.encKeyPack is in fact supposed to 
be SignedData then how does the reply key get encrypted with the 
client's public key?

--dpm

---

From: Love <[email-masked]>
Date: Sun, 23 May 2004 22:50:02 +0200

> (draft-ietf-cat-kerberos-pk-init-19.txt, expires September 30, 2004).

If I understand you mail correctly you are talking about the issue I have
tries to address in the mail, Message-ID: <[email-masked]> (see the archive).

Love