Subject: CALL FOR DISCUSSION - Do we want to specify EC in PKINIT?

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 14 Mar 2005 20:42:31 -0500

This is ticket #840

Through the last few revs of PKINIT, various text has been proposed related 
to supporting Diffie-Hellman exchanges using elliptic curve groups.  A 
number of changes we have already agreed on, particularly the use of 
AlgorithmIdentifier in TD-DH-PARAMETERS, insure that it will be possible 
for a separate document to specify support for EC groups in an 
interoperable way.

Actually specifying EC group support requires some additional text, 
including what algorithm OID's to use, how to derive the shared secret, and 
possible some RECOMMENDED groups for interoperability.  There may be other 
needed bits as well; I'm not sure.

The topic of this ticket is to determine whether there is support withing 
the working group for specifying EC groups support within the main PKINIT 
document, and if not, whether there is support for doing so in a separate 
standards-track document.  Much of the needed text is already in pkinit-25; 
however, if there is not a consensus to include this in PKINIT, that text 
will be removed.

So, I'd like to see some discussion on this issue.  I know this is not a 
cut-and-dried question; there are a number of issues and viewpoints which I 
expect will come out in the course of the discussion...

-- Jeff

---

From: Jeffrey Altman <[email-masked]>
Date: Tue, 15 Mar 2005 15:08:28 -0500

I would prefer that EC group support be defined in a second document
in much the same way that the OCSP support was.  PKINIT is a complex
document and I believe that we should keep it as simple as possible
in order to ensure smooth passage through a IETF Last Call and the IESG.

Jeffrey Altman

Jeffrey Hutzelman wrote:

> This is ticket #840
> 
> Through the last few revs of PKINIT, various text has been proposed 
> related to supporting Diffie-Hellman exchanges using elliptic curve 
> groups.  A number of changes we have already agreed on, particularly the 
> use of AlgorithmIdentifier in TD-DH-PARAMETERS, insure that it will be 
> possible for a separate document to specify support for EC groups in an 
> interoperable way.
> 
> including what algorithm OID's to use, how to derive the shared secret, 
> and possible some RECOMMENDED groups for interoperability.  There may be 
> other needed bits as well; I'm not sure.
> 
> The topic of this ticket is to determine whether there is support 
> withing the working group for specifying EC groups support within the 
> main PKINIT document, and if not, whether there is support for doing so 
> in a separate standards-track document.  Much of the needed text is 
> already in pkinit-25; however, if there is not a consensus to include 
> this in PKINIT, that text will be removed.
> 
> cut-and-dried question; there are a number of issues and viewpoints 
> which I expect will come out in the course of the discussion...
> 
> -- Jeff
> 
>

---

From: Sam Hartman <[email-masked]>
Date: Wed, 16 Mar 2005 19:43:04 -0500

>>>>> "Jeffrey" == Jeffrey Altman <[email-masked]> writes:

    Jeffrey> I would prefer that EC group support be defined in a
    Jeffrey> second document in much the same way that the OCSP
    Jeffrey> support was.  PKINIT is a complex document and I believe
    Jeffrey> that we should keep it as simple as possible in order to
    Jeffrey> ensure smooth passage through a IETF Last Call and the
    Jeffrey> IESG.

As an individual, I'd prefer that EC group discussion be done in a
separate document if at all.

I'm concerned about IPR issues.  Larry claims their are none.   Either of the following statements must be true:

1) There are IPR issues.  Thus we'd need two independent examples of
   IPR licensing to advance to draft.  I'm unconvinced we'll actually
   get that to happen.

2) There are no IPR issues.  That means we're doing something
    different with EC than the rest of the IETF.  If that's the case
    we should require significant review of the text.  Calling it out
    in its own document would accomplish that.

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Fri, 18 Mar 2005 01:08:54 +0100

Jeffrey Hutzelman <[email-masked]> writes:

> groups.  A number of changes we have already agreed on, particularly
> the use of AlgorithmIdentifier in TD-DH-PARAMETERS, insure that it
> will be possible for a separate document to specify support for EC
> groups in an interoperable way.

If its possible to support EC using AlgorithmIdentifier and the rest of the
infrastructure I don't mind breaking it out to a separate document.

I'm sure Larry will complete document that before the p-kinit base document
is done, just like the OCSP document. :)

Love

---

From: Brian Tung <[email-masked]>
Date: Fri, 18 Mar 2005 11:09:11 -0800

> in order to ensure smooth passage through a IETF Last Call and the IESG.

What he said.

Brian Tung <[email-masked]>