Subject: RE: TD-DH-PARAMETERS (Re: LAST CALL - Public Key Cryptography for Initial Authentication in Kerberos)

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 8 Nov 2005 18:09:34 -0800

Love and I have resolved this issue. I requested Love to propose the
text to the list and he already did. 

If no one objects to his proposal (see his latest posting), his text
shall be folded to -30, and -30 will be forwarded to IESG.

Thanks,

-- larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Tom Yu
Sent: Tuesday, November 08, 2005 2:15 PM
To: Jeffrey Hutzelman
Cc: [email-masked]
Subject: TD-DH-PARAMETERS (Re: LAST CALL - Public Key Cryptography for
Initial Authentication in Kerberos)

Regarding to Love's comment in the WG session, I have examined Section
3.2.2 of pkinit-29 and found that TD-DH-PARAMETERS is in fact
underspecified.  AlgorithmIdentifier is basically a typed hole, with
the contents being an ASN.1 type identified with an OID.  Section
3.2.2 does not specify what OID or ASN.1 type to use in
TD-DH-PARAMETERS.  I have looked at the the referenced standard, IEEE
1363, which does not itself specify any OIDs or ASN.1 types as far as
I can tell.  IEEE 1363 only really specifies the math behind using
DH.

What is probably meant is the OID and ASN.1 type in RFC 3279
associated with Diffie-Hellman domain parameters, which is in turn
based on ANSI X9.42 (which I don't think I have access to).

---Tom