Subject: pkinit-20: crypto algorithm identifiers

From: Ken Raeburn <[email-masked]>
Date: Mon, 2 Aug 2004 22:20:18 -0700

At the end of section 3.1.3, "Algorithm Identifiers":

"Kerberos data structures require the use of integer etypes, while CMS
objects use OIDs. Therefore, each cryptographic algorithm supported
by PKINIT is identified both by a CMS OID and by an equivalent
Kerberos etype (defined in section 3.1.2)."

I think this is misleading, if not actually wrong.  Aren't we just 
going to use OIDs for new algorithms added in the future, and keeping 
the existing etype values only for backwards compatibility with 
existing deployments?

Ken

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 3 Aug 2004 01:29:45 -0500

> the existing etype values only for backwards compatibility with 

I thought we'd resolved that there was no need to use non-Kerberos V
enctypes in Kerberos V EncryptedData and Checksum types, so, this looks
wrong, yes.

As for your question about the future, I think you're referring to my
proposal that we use a CHOICE OF Int32 and RELATIVE-OID in Kerberos V
extensions to identify types for typed holes.  I don't think we actually
reached WG consensus on that point (though mostly because we've had
other things to deal with); I don't think that's controversial, so we
could decided to do it, but it shouldn't be relevant in this context.

Nico
--

---

From: Love <[email-masked]>
Date: Tue, 03 Aug 2004 10:35:13 +0200

>> the existing etype values only for backwards compatibility with 
[...]
> could decided to do it, but it shouldn't be relevant in this context.

Ken is right, the draft is using OID's, see supportedCMSTypes in AuthPack.

Do we need to keep the compat glue, I can't remeber if microsoft sends
those enctype (or checks for them), how about packetcable ?

Love

---

From: Brian Tung <[email-masked]>
Date: Tue, 3 Aug 2004 10:05:05 -0700

> the existing etype values only for backwards compatibility with 

It is wrong.  When I put Love's proposed change into the ASN.1, I didn't
catch this related text.  I've put an item on my to-do list to fix this.

Brian Tung <[email-masked]>