Subject: pkinit-20 checksum problem

From: Ken Raeburn <[email-masked]>
Date: Mon, 2 Aug 2004 01:58:03 -0700

>3.1.  Definitions
 >3.1.1.  Required Algorithms
 >All PKINIT implementations MUST support the following algorithms:
 >    - Unkeyed checksum type for the paChecksum member of
 >      PKAuthenticator: SHA1 (unkeyed).

Ignoring for the moment that "definitions" in this sort of context 
usually applies to how terms are used, and not conformance 
requirements...

In the paChecksum field, if the required algorithm is used, what number 
is going to be present in the cksumtype field?  Where is the 
specification for the checksum type?

The Kerberos crypto document's checksum type table includes:

    Checksum type              sumtype        checksum         section or
                                 value            size         reference
    
----------------------------------------------------------------------
    sha1 (unkeyed)                  10              20             ??
    sha1 (unkeyed)                  14              20             ??

...but there is no specification for a "sha1" checksum type that I can 
find.

(One would assume that it would be the obvious: get_mic is the SHA-1 
output, octet for octet, verify_mic is get_mic-and-compare, any key 
type is compatible.  But it hasn't been written up.)

The value 14 was added to the table in 
draft-ietf-cat-kerberos-revisions-06.  I added 10 in 
draft-ietf-krb-wg-crypto-03 in 2003 after Assar told me that he 
believed it was also used for sha1, but I don't think he ever provided 
me any data to back it up.

After talking briefly with jhutz earlier tonight, I'd suggest we 
publish a spec (either a separate section in PKINIT, or a separate 
document that'd be more boilerplate than spec) for unkeyed SHA-1 in 
Kerberos, defining it as I outlined above, directing IANA to register 
that definition for checksum type 14 and to make 10 "reserved" or just 
delete it (making it available for assignment), unless we get something 
more solid on the use of #10.

Ken

---

From: Sam Hartman <[email-masked]>
Date: Mon, 02 Aug 2004 14:02:26 -0400

>>>>> "Ken" == Ken Raeburn <[email-masked]> writes:

    >> 3.1.  Definitions 3.1.1.  Required Algorithms All PKINIT
    >> implementations MUST support the following algorithms: -
    >> Unkeyed checksum type for the paChecksum member of

    Ken> Ignoring for the moment that "definitions" in this sort of
    Ken> context usually applies to how terms are used, and not
    Ken> conformance requirements...

Why must this checksum be unkeyed?  The KDC already knows the reply
key at this point.

---

From: Love <[email-masked]>
Date: Tue, 03 Aug 2004 13:51:34 +0200

> Why must this checksum be unkeyed?  The KDC already knows the reply

Its the client that send the AuthPack, it doesn't have the key.

Love