Subject: Re: Changing pkinit wire formats for stat-static dh

From: Love <[email-masked]>
Date: Tue, 03 Aug 2004 10:52:26 +0200

[email-masked] (Sam Hartman) writes:

> Larry and I have been discussing the wire formats and he proposes that
> we change the dhSignedData arm of the choice in the as-rep to be a
> sequence containing contentInfo and an optional server-side nonce.
> This would be cleaner but would be a backward incompatible change.
>
> If no one objects, I think we should make that change.  I'm expecting
> objections though; in particular I believe that would be inconvenient
> for Cable Labs.

I don't mind this change, I don't think its a wireformat change, the
PA-number will change, if the KDC uses dh with older client, just don't
send the optional field.

Love

---

From: Sam Hartman <[email-masked]>
Date: Tue, 03 Aug 2004 11:45:53 -0400

>>>>> "Love" == Love  <[email-masked]> writes:

    Love> [email-masked] (Sam Hartman) writes:

    >> Larry and I have been discussing the wire formats and he
    >> proposes that we change the dhSignedData arm of the choice in
    >> the as-rep to be a sequence containing contentInfo and an
    >> optional server-side nonce.  This would be cleaner but would be
    >> a backward incompatible change.
    >> 
    >> If no one objects, I think we should make that change.  I'm
    >> expecting objections though; in particular I believe that would
    >> be inconvenient for Cable Labs.

    Love> I don't mind this change, I don't think its a wireformat
    Love> change, the PA-number will change, if the KDC uses dh with
    Love> older client, just don't send the optional field.

This will certainly change the abstract syntax.  I'm not sure if it
will matter for BER-based encodings.