Subject: RE: pk-init-29

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 14 Nov 2005 12:08:02 -0800

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> 
> writes:

>>    Liqiang(Larry)> IMO, crypto-agility does not mean all algorithms
>>    Liqiang(Larry)> have to be negotiated on the wire. 

> No, that's exactly what it means.

What if the protocol has only one message, such as the case of GSS-API Kerberos with no server authentication? 

there are protocols out there can not be fixed in order to negotiate. I suspect SMIME/CMS falls into such category.

> We do need to look at hash agility both for the DH KDF and for
> signatures and for cert selection.  We don't need to support
> negotiation today but we do need to confirm we can add it in a
> backward compatible manner.

I believe this can be done with the help of extensibility marker we have today.

> In other words it needs to be the case that a KDC must return a well
> defined and unique error for each use of hashes and it must be the
> case that this error is intended to take TD.

In order to avoid another unsigned error, I would propose to allow signature algorithms in the supportedCMSTypes field of AuthPack.

          supportedCMSTypes       [2] SEQUENCE OF AlgorithmIdentifier
                                      OPTIONAL,
                   -- Type AlgorithmIdentifier is defined in
                   -- [RFC3280].
                   -- List of CMS signature and encryption algorithms 
                   -- supported by the client in order of (decreasing) 
                   -- preference.

Appropriate and equivalent language should be added into the main body as well.

This way, if an error occurs, the KDC does not need to send back anything other than an error (perhaps with text in the error).

Do you agree with this change then?

-- Larry

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Monday, November 14, 2005 11:48 AM
To: Liqiang(Larry) Zhu
Cc: Love Hörnquist Åstrand; [email-masked]
Subject: Re: pk-init-29

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    Liqiang(Larry)> IMO, crypto-agility does not mean all algorithms
    Liqiang(Larry)> have to be negotiated on the wire. 

No, that's exactly what it means.

For Love's initial question it is fine if the client sends all the
algorithms it supports because if the server returns an error then the
client cannot succeed.

We do need to look at hash agility both for the DH KDF and for
signatures and for cert selection.  We don't need to support
negotiation today but we do need to confirm we can add it in a
backward compatible manner.

In other words it needs to be the case that a KDC must return a well
defined and unique error for each use of hashes and it must be the
case that this error is intended to take TD.

---

From: Sam Hartman <[email-masked]>
Date: Tue, 15 Nov 2005 12:56:33 -0500

I don't object to your proposed change regarding cms algorithms
although I question whether we need that now or in the future.

What I do want to confirm is that for each use of hashes we have a
well defined error code so that future clients will know which
algorithm is not right.