Subject: Pkinit: cached DH half integrated

From: Sam Hartman <[email-masked]>
Date: Sat, 20 Nov 2004 16:48:26 -0500

It looks like the textual changes are there, but the corresponding
ASN.1 is not.

---

From: Brian Tung <[email-masked]>
Date: Sat, 20 Nov 2004 17:49:48 -0800

> It looks like the textual changes are there, but the corresponding

I'll fix it.

BTW, I have not yet received text from anyone for inclusion in pk-init-22.

Brian Tung <[email-masked]>

---

From: Nicolas Williams <[email-masked]>
Date: Sat, 20 Nov 2004 23:55:30 -0600

> BTW, I have not yet received text from anyone for inclusion in pk-init-22.

<embarrassment>
I took on one task at the meeting, but forget what it was.  Please
remind me?
</embarrassment>

---

From: Brian Tung <[email-masked]>
Date: Sat, 20 Nov 2004 22:02:15 -0800

> I took on one task at the meeting, but forget what it was.  Please

According to the minutes, you are on the slate for text on indicating
PKINIT support.

---

From: Nicolas Williams <[email-masked]>
Date: Sun, 21 Nov 2004 00:01:11 -0600

> According to the minutes, you are on the slate for text on indicating

Ah, yes.  And as I recall we decided on a minimalist approach.

Thanks.  I'll send text this week (it's just barely Sunday here).

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 23 Nov 2004 14:48:51 -0600

The following is the text for PKINIT support indication.

 - To section 3.1.2 add:

...
PKINIT makes use of the following new preauthentication types:

    PA-PK-AS-REQ                             TBD
    PA-PK-AS-REP                             TBD
+   PA-PK-AS-ERR                             TBD
...

Add this new section:

"
3.2.5  KDC Indication of PKINIT Support

   A KDC that supports PKINIT SHOULD indicate support for PKINIT to
   clients that did not include any or acceptable pre-authentication in
   their AS requests.  As per-clarifications [replace with proper
   reference] KDCs respond to such requests with a KRB-ERROR with
   KDC_ERR_PREAUTH_REQUIRED as the error code and with a list of
   pre-authentication data in the KRB-ERROR's e-data field.

   To indicate support for PKINIT, then, a KDC MUST include, in
   KDC_ERR_PREAUTH_REQUIRED KRB-ERROR messages, a padata element of type
   PA-PK-AS-ERR.  The padata-value field of this padata element MUST be
   set to the zero-length string; clients MUST ignore this and any other
   value.

   A client that receives a KRB-ERROR message, bearing a PA-PK-AS-ERR
   padata element, from a KDC in response to its AS-REQ should take the
   message as an indication of support by the KDC for PKINIT.  The
   client MAY respond by attempting a new AS exchange using its
   preferred pre-authentication mechanism for which the KDC has
   indicated support in its error message and for which the client has
   credentials, possibly including PKINIT.

   Future extensions to PKINIT may provide for the use of the value of
   PA-PK-AS-ERR padata elements to indicate such details as KDCs' PKI
   trust anchors, negotiation preferences, etc...
"

For the indication padata's value I went with a MUST-not-send-any/MUST-
ignore-any approach.  I don't think this language precludes extensions
as those would, presumably, update this RFC.

I'm not sure if any new security considerations text is necessary.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Tue, 23 Nov 2004 16:10:48 -0500

This text is fine.  I think I would probably have chosen one of the
existing padata types.

Doug, how do you feel about this approach compared to picking one of
the two allocated padata types?

--Sam

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 23 Nov 2004 15:38:25 -0600

> This text is fine.  I think I would probably have chosen one of the

I thought about this too but didn't do reuse an existing PA type for
consistency's sake.  Besides, having different PA types for different
value types may allow us to use the PA type as a constraint in a future
version of the ASN.1 module, or within an implementation's module.

Nico
--