Subject: RE: pkinit issues

From: "Eric Rosenfeld" <[email-masked]>
Date: Tue, 3 Aug 2004 10:43:37 -0600

Jeff,

Thanks for putting together this exhaustive list of open issues. I
really appreciate it. I have provided input on most of the OPEN issues.

Unfortunately, I will not be at the WG meeting due to a previously
scheduled engagement. I look forward to seeing the progress on PKINIT as
a result of the WG meeting.

Thanks,
Eric

Eric S. Rosenfeld
Project Director, PacketCable Security
CableLabs
858 Coal Creek Circle
Louisville, CO  80027-9750
Phone: 303-661-9100
Fax: 303-661-9199
Web: www.cablelabs.com
Email: [email-masked]
Direct Phone: 303-661-3841
Direct Fax: 303-664-8195

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: Monday, August 02, 2004 3:34 PM
To: [email-masked]
Subject: pkinit issues

I have spent some time collecting the complete state of some 40 issues
with PKINIT since Boulder, about half of which are resolved.  I have
assigned to each issue one of four states:

  DONE - resolved; no further work required
  OPEN - work is still required on this
  NEW  - this item is new with this post
  XXXX - I'm not sure whether this is resolved.

For the issues that are not DONE, I've summarized the current state
and broken them down into major, minor, and editorial issues.  All
of the major and minor issues will be touched on during this week's
working group meeting.

At the end, I have attached the list of all issues, both open and
closed,
and my complete notes on the discussion of each of these issues.  I hope
to have imported all of these issues into RT by the end of the week.

-- Jeff

======================================================================

First, the few major open issues which still require significant work
or are controversial.

*OPEN* 013 - OCSP and optional revocation information
  It seems to me that we have agreement that support for OCSP is a
  valuable feature.  We also seem to have converged on a single
  specification which includes the best parts of Nico's and Larry's
  proposals.  AT this week's WG meeting, we will discuss whether to
  incorporate this text into PKINIT or leave it as a separate
  document.

[ERIC] This should not be included in PKINIT.

*OPEN* 017 - DH key derivation
  This is the subject of what that Sam and Larry are currently
  working on.  We'll hear about the status of this at the meeting.

*OPEN* 031 - Which encoding - DER vs BER? (Love #2)

[ERIC] DER should be the only required encoding method. DER is the only
encoding method used in Kerberos. While CMS supports DER, we are using a
small set of CMS objects for Kerberos. So, within a Kerberos
environment, we should restrict encoding for these objects to DER.

*OPEN* 035 - Wrap CMS objects in octet-strings?
  These are related, and still under discussion.  It is my opinion that
  we seem to have support for wrapping all CMS objects in
OCTET-STRING's.
  I think we need a volunteer to write this text.

  I also want to hear from folks who have already tried implementing
  PKINIT, on two issues:
  (a) Does wrapping objects in OCTET-STRING's actually make it easier
      to implement PKINIT using off-the-shelf CMS libraries?
  (b) While this approach doesn't change the semantics of PKINIT,
      it is a nontrivial change to the wire protocol.  Is this going
      to cause problems for implementors?

[ERIC] Strongly object to this change. While the OCTET-STRINGs remove
one layer of encoding, it would also change the wire protocol. It was a
stated goal of the WG to not change the wire protocol.

======================================================================

This next group of issues are questions which need to be resolved by
the working group before this work can be considered complete.

*OPEN* 020 - Unauthenticated plaintext issues
  This issue seems to have been dropped on the floor.  We need a
  resolution on this before the document can move forward.

[ERIC] Sounds like Sam was only asking for some text in the security
considerations section. Is there anything else that needs to be
addressed?

*OPEN* 028 - Nonce type?
  This was opened back in February, and there was never any response.

[ERIC] Not sure what this is about. I don't believe there is an issue
with the nonce. Suggest closing this unless someone can explain what the
problem is.

*XXXX* 030 - What key should the reply be enveloped with in the
             encKey case? (Love #1)
  I don't see this addressed in discussion on the mailing list.

*OPEN* 034 - subjectAltName/OtherName issues (Love #7)
  I've seen no discussion addressing this item, either.

[ERIC] As I understand it, Love asked how the Name Constraints extention
can be used to limit the name space of the principal name in the KDC
certificate. This seems to be out of scope for PKINIT. Trying to solve
this problem in PKINIT would require that we define additional path
validation requirements, which I would object to.

*NEW* 038 - DH groups selection
  Both Love and I noticed that we are recommending use of RFC2409 groups
  1 and 2.  This isn't going to pass muster; we need to recommend one
  of the larger groups from RFC3526

[ERIC] We should add support for additional groups, but I would like to
retain backward compatibility with Groups 1 and 2.

*OPEN* 039 - Root CA cert in chain?
  Jeff, Sam, and Martin have discussed this at length, but I don't see
  a resolution.  We need conclusion on this question and appropriate
  text.

[ERIC] Including the Root CA cert should be a MAY.

*OPEN* 040 - encryption certificate change not protected
  Love brought this up in the last couple of days.

[ERIC] This should be fixed.

======================================================================

The remaining issues are mostly either editorial changes or things
which I suspect are closed but need confirmation on.

*XXXX* 002 - REMOVE use of raw public keys
  It was claimed this was done in -17, but I don't know what this is.

[ERIC] This was using public key crypto without certificates. I do
believe it was removed, so I recommend that this issue be closed.

*XXXX* 004 - Security of cached DH values and use of a nonce
  This was an "evaluate and propose" task.  I believe this has been
  completed, and the output is what lead to the current DH work.
  Can someone confirm this?

[ERIC] Sam and Larry are leading this effort, and I do believe the
security has been worked out. Pending confirmation from Sam and Larry,
propose closing this issue.

*XXXX* 005 - Confirm alignment with CMS
  Another "evaluate and propose" task.  Again, can someone confirm
  that this was actually done?

[ERIC] Todd Stecher from Microsoft was assigned this action item. I
believe he indicated that he was going to work with another Microsoft
employee (Phil?) on this. I don't believe this item was ever closed.

*OPEN* 007 - Confirm alignment with kerberos-clarifications
  Some minor editorial issues need to be cleaned up to close this.

[ERIC] Nico was assigned this action item.

*OPEN* 009 - Update PA types
  Still deferred until the last minute.

[ERIC] Cliff is supposed to address this at the end.

*OPEN* 021 - TrustedCAs context tags broken (Love #5)
  Another editorial item.  This was half-fixed, and needs to be
  fixed the rest of the way.

[ERIC] Brian needs to fix this.

*OPEN* 024 - cname mapping proposal
  I believe this was actually a spinoff of #023, and was resolved
  in the same way.  I'd like confirmation from Larry to that effect.

*OPEN* 026 - Unconstrained Integers (Love #6)
  There are still two uses of unconstrained INTEGER types.

[ERIC] Presumably Love is talking about the nonce in KDCDHKeyInfo and
cusec in PKAuthenticator. No objections to fixing this. Recommend
constraining cusec in PKAuthenticator to 0 - 999,999, and changing the
nonce to uint32.

*NEW* 037 - ASN.1 module inconsistency
  The module appendix is good, but not perfect.  It needs to be fixed.

======================================================================

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 3 Aug 2004 15:58:10 -0700

>      to implement PKINIT using off-the-shelf CMS libraries?

All CMS objects are wrapped as IMPLICIT OCTET STRING in the
released/current MS implementations.

>      to cause problems for implementors.

I am trying to get somebody who is more familiar with ASN.1 to respond
to this one, preferably Nico or Tom. At this point, I do not know if
there is any impact on the decoder side and I assume that is where you
have most of the concerns.

Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Eric
Rosenfeld
Sent: Tuesday, August 03, 2004 9:44 AM
To: Jeffrey Hutzelman; [email-masked]
Subject: RE: pkinit issues

Jeff,

Thanks,
Eric

Eric S. Rosenfeld

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]]
Sent: Monday, August 02, 2004 3:34 PM
To: [email-masked]
Subject: pkinit issues

-- Jeff

*OPEN* 028 - Nonce type?

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 3 Aug 2004 16:05:02 -0700

> stated goal of the WG to not change the wire protocol.

I do not think we have agreed upon a reference point therefore this is
moot. At Denver, I think we established that the current draft
completely broke backward-compatibility from draft -09, (the version
implemented by windows 2000), this is because of the changes in
PkAuthenticator.

Larry

-----Original Message-----

Jeff,

Thanks,
Eric

Eric S. Rosenfeld

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]]
Sent: Monday, August 02, 2004 3:34 PM
To: [email-masked]
Subject: pkinit issues

-- Jeff

*OPEN* 028 - Nonce type?