Subject: [KEYPROV] PSKC: Algorithm Profile

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 20 May 2010 03:00:07 +0300

Hi all,

I just had a brief chat with Peter about the algorithm profile.

The PSKC draft defines the algorithm profile as 
"urn:ietf:params:xml:ns:keyprov:pskc#hotp". Peter mentioned that the 
usage of the '#' character is discouraged.

His suggestion was to use the following syntax: 
"urn:ietf:params:xml:ns:keyprov:pskc:hotp".

Then, we had a discussion about the algorithm profiles we listed in 
http://tools.ietf.org/id/draft-hoyer-keyprov-pskc-algorithm-profiles-01.txt:
"urn:ietf:params:xml:ns:keyprov:pskc#OCRA-1:HOTP-SHA512-8:C-QN08"

There, Peter suggested to register
"urn:ietf:params:xml:ns:keyprov:pskc:OCRA-1
and then to put the parameters into a separate XML attribute.

Here is an example:

  <?xml version="1.0" encoding="UTF-8"?>
  <KeyContainer Version="1.0"
  xmlns="urn:ietf:params:xml:ns:keyprov:pskc:1.0">
      <Device>
          <DeviceInfo>
              <Manufacturer>TokenVendorAcme</Manufacturer>
              <SerialNo>987654322</SerialNo>
          </DeviceInfo>
          <Key Id="12345678"
          Algorithm=
      "urn:ietf:params:xml:ns:keyprov:pskc:OCRA-1"
          Parameter="HOTP-SHA512-8:C-QN08"
              <Issuer>Issuer</Issuer>
              <Usage CR="true">
                <ChallengeFormat Min="8" Max="8" Format="DECIMAL"/>
                <ResponseFormat Length="8" Format="DECIMAL"/>
              </Usage>
              <Data>
                <Secret>
                   <PlainValue>MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=</PlainValue>
                </Secret>
                <Counter>
                  <PlainValue>0</PlainValue>
                </Counter>
              </Data>
          </Key>
      </Device>
  </KeyContainer>

We would have to add that the "Parameter" attribute to PSKC.

What do others think?

Ciao
Hannes

---

From: "Bajaj, Siddharth" <[email-masked]>
Date: Mon, 24 May 2010 16:46:17 -0700

Hi Hannes, 

I think that Peter's suggestion would work. I would like to suggest one
minor modification - keep the algorithm as 'OCRA' and then add the
entire OCRASuite string as defined in the OCRA Spec as the parameter. 

Also, we could specify the hash algorithm used in TOTP using the same
parameter field. 

  <?xml version="1.0" encoding="UTF-8"?>
  <KeyContainer Version="1.0"
  xmlns="urn:ietf:params:xml:ns:keyprov:pskc:1.0">
      <Device>
          <DeviceInfo>
              <Manufacturer>TokenVendorAcme</Manufacturer>
              <SerialNo>987654322</SerialNo>
          </DeviceInfo>
          <Key Id="12345678"
          Algorithm="urn:ietf:params:xml:ns:keyprov:pskc:OCRA"
          Parameter="OCRA-1:HOTP-SHA512-8:C-QN08"
              <Issuer>Issuer</Issuer>
              <Usage CR="true">

Thanks,

Siddharth

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Hannes Tschofenig
Sent: Wednesday, May 19, 2010 5:00 PM
To: [email-masked]
Subject: [KEYPROV] PSKC: Algorithm Profile

Hi all,

Then, we had a discussion about the algorithm profiles we listed in 
http://tools.ietf.org/id/draft-hoyer-keyprov-pskc-algorithm-profiles-01.
txt:
"urn:ietf:params:xml:ns:keyprov:pskc#OCRA-1:HOTP-SHA512-8:C-QN08"

Here is an example:

              <Issuer>Issuer</Issuer>
              <Usage CR="true">

What do others think?

Ciao
Hannes

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov

---

From: "Philip Hoyer" <[email-masked]>
Date: Fri, 28 May 2010 15:37:27 +0200

Siddharth and all,

We already have a field called AlgorithmParameter tis is where you
define the behaviour of input parameters for OTP and CR for example the
challenge length. See Section 4.2.4 of the current draft.

So we could either put a Suite=xxx element in there or we could keep a
suite attribute in the Key element.

So either:

   <KeyContainer Version="1.0" Id="exampleID1"

        xmlns="urn:ietf:params:xml:ns:keyprov:pskc">

       <KeyPackage>

           <DeviceInfo>

               <Manufacturer>Manufacturer</Manufacturer>

               <SerialNo>987654321</SerialNo>

           </DeviceInfo>

           <CryptoModuleInfo>

               <Id>CM_ID_001</Id>

           </CryptoModuleInfo>

           <Key Id="12345678"

            Algorithm="urn:ietf:params:xml:ns:keyprov:pskc:OCRA">

               <Issuer>Issuer</Issuer>

               <AlgorithmParameters>

                   <Suite> OCRA-1:HOTP-SHA512-8:C-QN08<Suite>

                   <ResponseFormat Length="8" Encoding="DECIMAL"/>

                  <ChallengeFormat Min="8" Max="8" Encoding="DECIMAL"/>

               </AlgorithmParameters>

               <KeyProfileId>keyProfile1</KeyProfileId>

               <KeyReference>MasterKeyLabel

               </KeyReference>

               <Data>

                   <Counter>

                   </Counter>

               </Data>

               <Policy>

                   <KeyUsage>OTP</KeyUsage>

               </Policy>

           </Key>

       </KeyPackage>

   </KeyContainer>

Or

   <KeyContainer Version="1.0" Id="exampleID1"

        xmlns="urn:ietf:params:xml:ns:keyprov:pskc">

       <KeyPackage>

           <DeviceInfo>

               <Manufacturer>Manufacturer</Manufacturer>

               <SerialNo>987654321</SerialNo>

           </DeviceInfo>

           <CryptoModuleInfo>

               <Id>CM_ID_001</Id>

           </CryptoModuleInfo>

           <Key Id="12345678"

            Algorithm="urn:ietf:params:xml:ns:keyprov:pskc:OCRA"
Suite="OCRA-1:HOTP-SHA512-8:C-QN08">

               <Issuer>Issuer</Issuer>

               <AlgorithmParameters>

                   <ResponseFormat Length="8" Encoding="DECIMAL"/>

                  <ChallengeFormat Min="8" Max="8" Encoding="DECIMAL"/>

               </AlgorithmParameters>

               <KeyProfileId>keyProfile1</KeyProfileId>

               <KeyReference>MasterKeyLabel

               </KeyReference>

               <Data>

                   <Counter>

                   </Counter>

               </Data>

               <Policy>

                   <KeyUsage>OTP</KeyUsage>

               </Policy>

           </Key>

       </KeyPackage>

   </KeyContainer>

Also note that some of the information of the OCRA Suite are effectively
in the <ChallengeFormat> and <ResponseFormat> elements already.

Thoughts?

Philip

________________________________

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Bajaj, Siddharth
Sent: Tuesday, May 25, 2010 12:46 AM
To: Hannes Tschofenig; [email-masked]
Cc: [email-masked]; Bajaj, Siddharth
Subject: Re: [KEYPROV] PSKC: Algorithm Profile

Hi Hannes, 

      <Device>

          <DeviceInfo>

          </DeviceInfo>

          <Key Id="12345678"

              <Issuer>Issuer</Issuer>

              <Usage CR="true">

              </Usage>

              <Data>

                <Secret>

                </Secret>

                <Counter>

                </Counter>

              </Data>

          </Key>

      </Device>

  </KeyContainer>

Thanks,

Siddharth

-----Original Message-----

Hi all,

Here is an example:

      <Device>

          <DeviceInfo>

          </DeviceInfo>

          <Key Id="12345678"

          Algorithm=

              <Issuer>Issuer</Issuer>

              <Usage CR="true">

              </Usage>

              <Data>

                <Secret>

                </Secret>

                <Counter>

                </Counter>

              </Data>

          </Key>

      </Device>

  </KeyContainer>

What do others think?

Ciao

Hannes

KEYPROV mailing list

[email-masked]

---

From: Sean Turner <[email-masked]>
Date: Fri, 28 May 2010 18:07:56 -0400

Philip Hoyer wrote:
>             *Algorithm="urn:ietf:params:xml:ns:keyprov:pskc:OCRA"*>
> 
>                <Issuer>Issuer</Issuer>
> 
>                <AlgorithmParameters>
> 
>                   * <Suite>** OCRA-1:HOTP-SHA512-8:C-QN08<Suite>***
> 
>                   <ChallengeFormat Min="8" Max=”8” Encoding="DECIMAL"/>
> 
>                </AlgorithmParameters>
> 
>             *Algorithm="urn:ietf:params:xml:ns:keyprov:pskc:OCRA" 
> Suite=”**OCRA-1:HOTP-SHA512-8:C-QN08”*>
> 
>                <Issuer>Issuer</Issuer>
> 
>                <AlgorithmParameters>
> 
>                   <ChallengeFormat Min="8" Max=”8” Encoding="DECIMAL"/>
> 
>                </AlgorithmParameters>
> 

I guess I'd prefer to not have two fields called algorithm.  Suite is 
okay with me.  If I'd had to pick, I'd probably go with the 1st one. 
The parameters field now has two things that are related.  This third 
thing isn't so related.

spt

> 
>  
> 
>  
> 
> ------------------------------------------------------------------------
> 
> *From:* [email-masked] [mailto:[email-masked]] *On 
> Behalf Of *Bajaj, Siddharth
> *Sent:* Tuesday, May 25, 2010 12:46 AM
> *To:* Hannes Tschofenig; [email-masked]
> *Cc:* [email-masked]; Bajaj, Siddharth
> *Subject:* Re: [KEYPROV] PSKC: Algorithm Profile
> 
>  
> 
> Hi Hannes,
> 
>           Algorithm="urn:ietf:params:xml:ns:keyprov:pskc:*OCRA*"
> 
> *          Parameter="OCRA-1:HOTP-SHA512-8:C-QN08"*
> 
>            >
> 
>               <Issuer>Issuer</Issuer>
> 
>               <Usage CR="true">
> 
> ------------------------------------------------------------------------
>

---

From: "Bajaj, Siddharth" <[email-masked]>
Date: Fri, 28 May 2010 16:32:17 -0700

Hi Philip,

Both the approaches that you have described gets the job done. 

Even though the first approach of adding an element called 'Suite' under
AlgorithmParameters seems more consistent, I don't have a strong opinion
either ways. So at this point I'm ok with whichever change that is easy
to make given that PSKC is in last call. Thanks,

Siddharth

-----Original Message-----
From: Sean Turner [mailto:[email-masked]] 
Sent: Friday, May 28, 2010 3:08 PM
To: Philip Hoyer
Cc: Bajaj, Siddharth; Hannes Tschofenig; [email-masked];
[email-masked]
Subject: Re: [KEYPROV] PSKC: Algorithm Profile

> Suite="**OCRA-1:HOTP-SHA512-8:C-QN08"*>
> 
>                <Issuer>Issuer</Issuer>
> 
>                <AlgorithmParameters>
> 

spt