Subject: RE: Changing pkinit wire formats for stat-static dh

From: "Eric Rosenfeld" <[email-masked]>
Date: Thu, 26 Aug 2004 11:05:47 -0600

Sam,

Can you provide the updated ASN.1 so we all understand exactly what you
are proposing? Given that there is some debate on whether this is a
change to the wire-protocol, the ASN.1 will help everyone understand the
impact. 

In principle, I am not opposed to the change, even if it is a change to
encoding. There are already other changes to the wire protocol. This
straw won't make a difference because the Camel's back is already
broken.

Thanks,
Eric

Eric S. Rosenfeld
Project Director, PacketCable Security
CableLabs
858 Coal Creek Circle
Louisville, CO  80027-9750
Phone: 303-661-9100
Fax: 303-661-9199
Web: www.cablelabs.com
Email: [email-masked]
Direct Phone: 303-661-3841
Direct Fax: 303-664-8195

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Tuesday, August 03, 2004 9:46 AM
To: Love
Cc: [email-masked]
Subject: Re: Changing pkinit wire formats for stat-static dh

>>>>> "Love" == Love  <[email-masked]> writes:

    Love> [email-masked] (Sam Hartman) writes:

    >> Larry and I have been discussing the wire formats and he
    >> proposes that we change the dhSignedData arm of the choice in
    >> the as-rep to be a sequence containing contentInfo and an
    >> optional server-side nonce.  This would be cleaner but would be
    >> a backward incompatible change.
    >> 
    >> If no one objects, I think we should make that change.  I'm
    >> expecting objections though; in particular I believe that would
    >> be inconvenient for Cable Labs.

    Love> I don't mind this change, I don't think its a wireformat
    Love> change, the PA-number will change, if the KDC uses dh with
    Love> older client, just don't send the optional field.

This will certainly change the abstract syntax.  I'm not sure if it
will matter for BER-based encodings.