Subject: Re: [Ietf-krb-wg] Review of draft-ietf-krb-wg-pkinit-alg-agility-06

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 04 Sep 2012 20:22:34 -0400

On Fri, 2012-03-09 at 21:53 -0500, Jeffrey Hutzelman wrote:

> I need someone to validate the ASN.1 module in Appendix A.
> 
> I would also like to hear from anyone who has implemented this
> specification or is planning to do so, and particularly from anyone who
> was able to verify the test vectors in section 7.

I never got any responses to these points.
Verification of the ASN.1 module is more or less a requirement for the
document to progress.  The others are not essential but will aid me in
producing a useful writeup.

-- Jeff

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Greg Hudson <[email-masked]>
Date: Wed, 05 Sep 2012 16:28:40 -0400

>> I need someone to validate the ASN.1 module in Appendix A.

asn1c accepts it, with one proviso.  For the sake of its output model,
asn1c insists that all type names be unique.  The module in the draft
extends the AuthPack and DHRepInfo sequences, using the same names as in
RFC 4556.  To get asn1c to accept the module, those types have to be
renamed.

I was hoping to verify that asn1c actually produces encodings consistent
with our implementation of the spec, but I ran into a weird
inconsistency with asn1c's encoding of PrincipalName (from RFC 4120) and
need to work through that.

>> was able to verify the test vectors in section 7.

I didn't write it personally, but we have an implementation of this spec
in MIT krb5.  I'll need to follow up (hopefully today, maybe tomorrow)
on whether we can verify the test vectors.

---

From: Greg Hudson <[email-masked]>
Date: Wed, 05 Sep 2012 23:42:05 -0400

>> was able to verify the test vectors in section 7.

I just reviewed our test cases, and yes, we are verifying all of the
test vectors for our implementation (the outputs in 7.2.2, 7.3.2, and
7.4.2).