Subject: [Ietf-krb-wg] proposed text for combining the reply key and the ticket session key of PKINIT in draft-ietf-krb-wg-anon-08.txt

From: Larry Zhu <[email-masked]>
Date: Mon, 18 Aug 2008 17:53:06 -0700

This is a follow up on combining PKINIT keys. Here is the proposed text. Tom has kindly assigned the two numbers used in the proposed text below. please review. Thanks.

6.  The Choice of the Ticket Session Key of a Ticket Obtained using
    PKINIT

   The definition in this section is motivated by protocol analysis of
   anonymous PKINIT (defined in this document) in building Kerberos
   [FAST] tunneling channels and subsequent channel bindings.  There is
   otherwise no connection of this section with the rest of this
   document.

   PKINIT is useful in conjunction with Kerberos [FAST] to construct
   tunneling channels.  To ensure that an attacker cannot create a
   channel with a given name, it is desirable that neither the KDC nor
   the client can unilaterally determine the ticket session key.  To
   achieve that end, a KDC conforming to this definition MUST encrypt a
   randomly generated session key in the PA_PKINIT_KX padata, and that
   session key MUST then be combined with the reply key to form the
   ticket session key of the returned ticket.  These two protocol keys
   are combined using KRB-FX-CF2 as defined in [FAST], where the input
   pepper1 is the ASCII string "PKINIT" and the input pepper2 is ASCII
   string "KeyExchange".

    PA_PKINIT_KX      129
       -- padata for PKINIT that contains an encrypted Kerberos
       -- session key.

    PA-PKINIT-KX  ::= EncryptedData -- EncryptionKey
       -- Contains an encrypted Kerberos session key randomly
       -- generated by the KDC.
       -- Both EncryptedData and EncryptionKey are defined in [RFC4120]

   The PA_PKINIT_KX padata MUST be included in the KDC reply when PKINIT
   is used.  The padata-value field of the PA-PKINIT-KX type padata
   contains the DER [X680] [X690] encoding of the Abstract Syntax
   Notation One (ASN.1) type PA-PKINIT-KX.  The PA-PKINIT-KX structure
   is a EncryptedData.  The clear text data being encrypted is the DER
   encoded Kerberos session key randomly generated by the KDC.  The
   encryption key is the reply key and the key usage number is
   KEY_USAGE_PA_PKINIT_KX (44).

   A conforming client MUST reject a PKINIT authentication if the
   PA_PKINIT_KX padata is not present in the KDC reply or if the ticket
   session key of the returned ticket is not the combined key of the
   encryption key in the PA-PKINIT-KX structure and the reply key.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 22 Aug 2008 16:39:43 -0400

--On Monday, August 18, 2008 05:53:06 PM -0700 Larry Zhu 
<[email-masked]> wrote:

> This is a follow up on combining PKINIT keys. Here is the proposed text.
> Tom has kindly assigned the two numbers used in the proposed text below.
> please review. Thanks.

This section introduces a completely new protocol behavior which was not in 
the document that went through working group or IETF last call.  As such, I 
think it raises the complexity of changes to this document to a level that 
requires a new WG last call.  It also introduces a normative dependency on 
FAST.

I would like to see comments from WG participants on whether this mechanism 
should be included.  If there appears to be sufficient support, then the 
new text will appear in whatever draft version is the subject of the next 
WGLC.

-- Jeff