Subject: ECC PKINIT ID moving to the next steps

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 5 Jul 2006 02:38:25 -0700

Daniel Brown ([email-masked]) reviewed this I-D and suggested two
inprovements:

1) in the security consideration section, insert the following
paragraph:

"When using ECDH key agreement, the recipient of an elliptic curve
public key should perform certain checks to avoid the attacks described
in [ECC-Validation].  It is especially important if the recipient is
using a long-term ECDH private key to check that the sender's public key
is a valid point on the correct elliptic curve, otherwise information
may be leaked about the recipient's private key, and iterating the
attack will eventually completely 
expose the recipient's private key." 

With the following referecne:

[ECC-Validation] A. Antipa, D. Brown, A. Menezes, R. Struik and S.
Vanstone, "Validation of Elliptic Curve Public Keys",  Public Key
Crytpography - PKC 2003, pp. 211- 223, LNCS 2567, Springer, 2003.

2)RFC 3278 should be added as a reference. For that, I propose the
following changes:

Section 3, first paragraph:

REPLACE OLD:
  ECC certificates and signature schemes can be used in the
   Cryptographic Message Syntax (CMS) [RFC3369] content type
   'SignedData'.

With NEW:

   ECC certificates and signature schemes can be used in the
   Cryptographic Message Syntax (CMS) [RFC3369] [RFC3278] content type
   'SignedData'.

And in the references section, add RFC3278.

Jeff can comment on if these changes can be handled as notes to the
editors.

Thanks,

-- larry

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 05 Jul 2006 11:46:27 -0400

> Daniel Brown ([email-masked]) reviewed this I-D and suggested two

We recently concluded a last call on this document, and Dan's suggestions 
are the last comments I know of that need to be addressed.  I need to hear 
comments on the proposed changes from other WG participants, preferably in 
the next few days.  Of course, if there are objections or other comments, 
we'll deal with them, but if everyone is OK with this change, I want to 
send this document to the IESG next week.

-- Jeff