Subject: RE: I-D ACTION:draft-ietf-cat-kerberos-pk-init-20.txt

From: "Eric Rosenfeld" <[email-masked]>
Date: Thu, 22 Jul 2004 11:03:16 -0600

Larry,

Jeff indicated that he was working through his list of issues. Let's
wait for a response from him before compiling a laundry list.

I do believe that pkinit-20 addresses:

- AD-INITIAL-VERIFIED-CAS - Uses Nico's proposed text. I have dropped my
objections to this field.

- OCSP - Removed, and will be addressed in a separate draft (I have
already commented to Brian that the OCSP reference and some OCSP objects
still remain in pkinit-20 and need to be removed).

- DH key derivation - No change. It seems to be the consensus that the
method is secure.

- ASN.1 module - Included the ASN.1 module compiled by Love, I believe.

The goal of my email was not to ask for a last call, but to verify that
there is only one remaining issue that is awaiting text (addition of
server-nonce to support caching DH keys).

-Eric

Eric S. Rosenfeld
Project Director, PacketCable Security
CableLabs
858 Coal Creek Circle
Louisville, CO  80027-9750
Phone: 303-661-9100
Fax: 303-661-9199
Web: www.cablelabs.com
Email: [email-masked]
Direct Phone: 303-661-3841
Direct Fax: 303-664-8195

-----Original Message-----
From: Liqiang(Larry) Zhu [mailto:[email-masked]] 
Sent: Thursday, July 22, 2004 10:16 AM
To: Eric Rosenfeld; [email-masked]
Subject: RE: I-D ACTION:draft-ietf-cat-kerberos-pk-init-20.txt

Eric, to expedite the process, can you compile a laundry list of issues
that were raised on this list, and summarize how each issue was
addressed in -20. This will help Jeff/Doug make the decision if he can
start the last call.

Thanks, Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Eric
Rosenfeld
Sent: Thursday, July 22, 2004 7:40 AM
To: [email-masked]
Subject: RE: I-D ACTION:draft-ietf-cat-kerberos-pk-init-20.txt

I'd like to thank Brian for getting pkinit-20 ready for the WG meeting
in August. In anticipation of the meeting, I'd like to confirm that,
subject to review of the latest draft, everyone believes that all issues
have been addressed except for caching of DH keys. Please respond to
this email if you believe there are other open issues.

Sam is working on some text for caching DH keys, and believes he can
send something to the WG by Monday, July 23rd.

Thanks,
Eric

Eric S. Rosenfeld
Project Director, PacketCable Security
CableLabs
858 Coal Creek Circle
Louisville, CO  80027-9750
Phone: 303-661-9100
Fax: 303-661-9199
Web: www.cablelabs.com
Email: [email-masked]
Direct Phone: 303-661-3841
Direct Fax: 303-664-8195

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Tuesday, July 20, 2004 2:13 PM
To: [email-masked]
Cc: [email-masked]
Subject: I-D ACTION:draft-ietf-cat-kerberos-pk-init-20.txt

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Kerberos WG Working Group of the IETF.

	Title		: Public Key Cryptography for Initial
Authentication in Kerberos
	Author(s)	: B. Tung, et al.
	Filename	: draft-ietf-cat-kerberos-pk-init-20.txt
	Pages		: 0
	Date		: 2004-7-20
	
This draft describes protocol extensions (hereafter called PKINIT)
to the Kerberos protocol specification (RFC 1510bis [1]).  These
extensions provide a method for integrating public key cryptography
into the initial authentication exchange, by passing cryptographic
certificates and associated authenticators in preauthentication data
fields.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-cat-kerberos-pk-init-20.t
xt

To remove yourself from the I-D Announcement list, send a message to 
[email-masked] with the word unsubscribe in the body of
the message.  
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the
username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-cat-kerberos-pk-init-20.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-cat-kerberos-pk-init-20.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail
readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Jeffrey Altman <[email-masked]>
Date: Thu, 22 Jul 2004 13:35:03 -0400

>still remain in pkinit-20 and need to be removed).
I don't remember Jeff or Doug indicating there was group consensus on 
this.  Text was presented
to the group to demonstrate how trivial the OSCP cached response support 
is.  It is still up to
the chairs to determine when consensus has been reached.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 22 Jul 2004 14:03:15 -0400

On Thursday, July 22, 2004 13:35:03 -0400 Jeffrey Altman 
<[email-masked]> wrote:

> this.  Text was presented to the group to demonstrate how trivial the
> OSCP cached response support is.  It is still up to the chairs to
> determine when consensus has been reached.

Fine; how's this...

I believe there is fairly strong support for specifying OSCP tunneling in 
some form.  Nico has attempted to demonstrate that it can be done in a 
separate draft, and simply enough that it won't likely fail due to lack of 
attention.

So, I will ask two questions, and then make a determination...

(1) Is anyone opposed to specifying OSCP tunneling at all?

(2) Does anyone still believe OSCP tunneling must be defined as part
    of PKINIT in order to be useful?

-- Jeff

---

From: Love <[email-masked]>
Date: Thu, 22 Jul 2004 20:06:11 +0200

> I do believe that pkinit-20 addresses:
[....]
> - DH key derivation - No change. It seems to be the consensus that the

Not for the static-static case, and I think larry manage to convince Sam of
that too.

Love

---

From: Sam Hartman <[email-masked]>
Date: Thu, 22 Jul 2004 14:27:12 -0400

>>>>> "Love" == Love  <[email-masked]> writes:

    Love> Not for the static-static case, and I think larry manage to
    Love> convince Sam of that too.

O, I realized we didn't support static-static all along.  IT took a
long time for me to understand that was Larry's only requirement.

I'm working on that now though.

---

From: Sam Hartman <[email-masked]>
Date: Thu, 22 Jul 2004 14:28:15 -0400

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> (2) Does anyone still believe OSCP tunneling must be
    Jeffrey> defined as part of PKINIT in order to be useful?

I think I feel more comfortable with Larry's text than Nico's text
because I believe more people focused on Larry's text for review.  I
consider both texts acceptable though.  I see no reason Larry's text
couldn't be in its own draft.

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 22 Jul 2004 13:34:04 -0500

> Not for the static-static case, and I think larry manage to convince Sam of

And me.  I don't care that much about this, but it seems to me that
adding the necessary nonce fields and key derivation text is not hard at
all, much less controversial, so how about we stop arguing about it and
put it in?

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 22 Jul 2004 13:44:53 -0500

> couldn't be in its own draft.

Agreed.  For example, Larry's version uses SEQUENCE OF OCSP responses,
which can allow for the entire cert trust chain to be validated with the
help of OCSP.

But have you all noted the security consideration in my I-D?  Quoth:

3.  Security Considerations

   There is a downgrade attack against clients which want an OCSP
   response from the server for the server's certificate if the clients
   do not treat the absence of a valid OCSP response as an error.

This should not be a problem, and if it is then the OCSP messages must
be moved into the PKINIT pre-auth.

Cheers,

Nico
--

---

From: Love <[email-masked]>
Date: Thu, 22 Jul 2004 22:05:49 +0200

> I'm working on that now though.

Talking about DH, I'm not sure I like,

    5.  If a Diffie-Hellman key is being used, the parameters SHOULD
        be chosen from the First or Second defined Oakley Groups.
        (See RFC 2409 [10].)

How about choosing a group or two from RFC3526 instead.

Love