Subject: [Ietf-krb-wg] With moderate speed: resolving channels and anonymous pkinit

From: Sam Hartman <[email-masked]>
Date: Wed, 16 Sep 2009 15:05:33 -0400 (EDT)

Dog fanciers, Love,

IN Dublin, we realized that anonymous pkinit needed to prove that the
KDC and client had both contributed to the TGS session key, so that
anonymous pkinit could be used to construct a channel for FAST, etc.

Larry and I came up with a proposal in the draft  which is to send back additional padata.

Love didn't like this proposal because he had something simpler.  I
don't remember what it is, or whether we discussed it.

With moderate urgency (say resolving within a few weeks if possible)
I'd like to figure out what we're going to do about this.

Love, could you remind us what your proposal is?

--Sam
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Wed, 16 Sep 2009 12:11:12 -0700

Sam,

> Love, could you remind us what your proposal is?

Require use of existing client and server nonce used for persistent DH  
keys when using anonymous. Using client and server nonce do not  
require you to use persistent keys, nonces enables them.

Love

---

From: Sam Hartman <[email-masked]>
Date: Wed, 16 Sep 2009 15:51:21 -0400

>>>>> "Love" == Love Hörnquist Åstrand <[email-masked]> writes:

    Love> Sam,
    >> Love, could you remind us what your proposal is?

    Love> Require use of existing client and server nonce used for
    Love> persistent DH keys when using anonymous. Using client and
    Love> server nonce do not require you to use persistent keys,
    Love> nonces enables them.

Remind me how this creates a client contribution to the TGS session key.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Wed, 16 Sep 2009 14:50:19 -0700

> Remind me how this creates a client contribution to the TGS session  

Derive the session from the reply key when dh reply keys is used ?

Love

---

From: Sam Hartman <[email-masked]>
Date: Thu, 17 Sep 2009 14:08:23 -0400

Love> Sam,
    >> Remind me how this creates a client contribution to the TGS

    Love> Derive the session from the reply key when dh reply keys is
    Love> used ?

I'm notsure what the nonces bring to this.  It semes like if you use
the DH key to generate the session key, then you're fine.  The
challenge is making it possible for the client to prove that happened.

I seem to recall you saying that the pkinit hash agility work made
this easier?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Thu, 17 Sep 2009 11:20:18 -0700

> challenge is making it possible for the client to prove that happened.

Why is there a challange ? just have the client generate the same key  
and verify they are the same.

> I seem to recall you saying that the pkinit hash agility work made

when doing switch to agility, session key derived from reply key can  
be mandated.

Love