Subject: [Ietf-krb-wg] allocated numbers in preauth framework -11

From: Larry Zhu <[email-masked]>
Date: Thu, 2 Apr 2009 16:38:38 -0700

The following is going into -11 in the preauth framework document. Please let me know if you find any conflicts or inconsistency in the allocations.

      Type                Value    Reference
  ----------------------------------------------------------------------
  PA-TGS-REQ                 1    RFC 4120
  PA-ENC-TIMESTAMP           2    RFC 4120
  PA-PW-SALT                 3    RFC 4120
  [reserved]                 4
  PA-ENC-UNIX-TIME           5    (deprecated)
  PA-SANDIA-SECUREID         6
  PA-SESAME                  7
  PA-OSF-DCE                 8
  PA-CYBERSAFE-SECUREID      9
  PA-AFS3-SALT               10
  PA-ETYPE-INFO              11   RFC 4120
  PA-SAM-CHALLENGE           12   (sam/otp)
  PA-SAM-RESPONSE            13   (sam/otp)
  PA-PK-AS-REQ_OLD           14   draft-ietf-cat-kerberos-pk-init-09
  PA-PK-AS-REP_OLD           15   draft-ietf-cat-kerberos-pk-init-09
  PA-PK-AS-REQ               16   RFC 4556
  PA-PK-AS-REP               17   RFC 4556
  PA-ETYPE-INFO2             19   RFC 4120
  PA-USE-SPECIFIED-KVNO      20
  PA-SAM-REDIRECT            21   (sam/otp)
  PA-GET-FROM-TYPED-DATA     22   (embedded in typed data)
  TD-PADATA                  22   (embeds padata)
  PA-SAM-ETYPE-INFO          23   (sam/otp)
  PA-ALT-PRINC               24   ([email-masked])
  PA-SAM-CHALLENGE2          30   ([email-masked])
  PA-SAM-RESPONSE2           31   ([email-masked])
  PA-EXTRA-TGT               41   Reserved extra TGT
  TD-PKINIT-CMS-CERTIFICATES 101  CertificateSet from CMS
  TD-KRB-PRINCIPAL           102  PrincipalName
  TD-KRB-REALM               103  Realm
  TD-TRUSTED-CERTIFIERS      104  PKINIT
  TD-CERTIFICATE-INDEX       105  PKINIT
  TD-APP-DEFINED-ERROR       106  Application specific
  TD-REQ-NONCE               107  INTEGER
  TD-REQ-SEQ                 108  INTEGER
  PA-PAC-REQUEST             128  MS-KILE
  PA-FOR_USER                129  MS-KILE
  PA-FOR-X509-USER           130  MS-KILE
  PA-FOR-CHECK_DUPS          131  MS-KILE
  PA-AS-CHECKSUM             132  MS-KILE
  PA-FX-COOKIE               133  draft-ietf-krb-wg-preauth-framework
  PA-AUTHENTICATION-SET      134  draft-ietf-krb-wg-preauth-framework
  PA-AUTH-SET-SELECTED       135  draft-ietf-krb-wg-preauth-framework
  PA-FX-FAST                 136  draft-ietf-krb-wg-preauth-framework
  PA-FX-ERROR                137  draft-ietf-krb-wg-preauth-framework
  PA-ENCRYPTED-CHALLENGE     138  draft-ietf-krb-wg-preauth-framework
  PA-OTP-CHALLENGE           141  ([email-masked])
  PA-OTP-REQUEST             142  ([email-masked])
  PA-OTP-CONFIRM             143  ([email-masked])
  PA-OTP-PIN-CHANGE          144  ([email-masked])
  PA-EPAK-AS-REQ             145  ([email-masked])
  PA-EPAK-AS-REP             146  ([email-masked])
  PA_PKINIT_KX               147  draft-ietf-krb-wg-anon
  PA_PKU2U_NAME              148  draft-zhu-pku2u
  PA-SUPPORTED-ETYPES        165  MS-KILE
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Thu, 2 Apr 2009 16:46:19 -0700

>  PA-FX-COOKIE               133  draft-ietf-krb-wg-preauth-framework

I though client referrals used 133.

Love

---

From: Larry Zhu <[email-masked]>
Date: Thu, 2 Apr 2009 16:52:51 -0700

>I though client referrals used 133.

Negative :-).

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Love Hörnquist Åstrand
Sent: Thursday, April 02, 2009 4:46 PM
To: Larry Zhu
Cc: [email-masked]
Subject: Re: [Ietf-krb-wg] allocated numbers in preauth framework -11

Love

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Thu, 2 Apr 2009 16:57:08 -0700

So what is client referrals using then ?

Love

2 apr 2009 kl. 16:52 skrev Larry Zhu:

> From: [email-masked] [mailto:ietf-krb-wg- 
> [email-masked]] On Behalf Of Love Hörnquist Åstrand

---

From: "Henry B. Hotz" <[email-masked]>
Date: Thu, 2 Apr 2009 19:09:08 -0700

I'd like to hear Gareth Richards confirm the OTP numbers will match.

>      Type                Value    Reference

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: <[email-masked]>
Date: Fri, 3 Apr 2009 04:45:31 -0400

They match the OTP pre-auth ID 

> From: Henry B. Hotz [mailto:[email-masked]] 
> Sent: 03 April 2009 03:09
> To: Larry Zhu; Richards, Gareth
> Cc: [email-masked]
> The opinions expressed in this message are mine, not those of 
> Caltech, JPL, NASA, or the US Government.

---

From: Tim Alsop <[email-masked]>
Date: Fri, 3 Apr 2009 10:38:15 +0100

Larry,

I noticed the PA-CYBERSAFE-SECUREID (value 9).

This value was used in a very old version of our product, that no customer uses anymore, so it would be safe to re-allocate this value for another usage.
In our latest implementation of OTP authentication, for RSA SecurID, VASCO Digipass, Safeword etc. we use PA-ENC-SAMPROTOCOL and this has value -7. This SAM protocol is propriatory to our product/company and not described in a draft/rfc. We are working on the FAST pre-auth framework and also the OTP draft authored by Gareth which will eventually replace this so our OTP support will then be standards based.

Thanks,
Tim Alsop
CyberSafe Limited

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Larry Zhu
Sent: 03 April 2009 00:39
To: [email-masked]
Subject: [Ietf-krb-wg] allocated numbers in preauth framework -11

      Type                Value    Reference