Subject: pkinit and signature of reply

From: Sam Hartman <[email-masked]>
Date: Sat, 08 Nov 2003 16:55:25 -0500

i'M WORKING ON THOSE PKINIT PROTOCOL CHANGES i SAID i'D HAVE READY BY
THE ietf.  tHE GOOD NEWS IS THAT IT LOOKS LIKE THE CHANGES i WILL
PROPOSE WILL BE VERY SMALL--POSSIBLY EVEN THE EMPTY SET OF CHANGES.
The bad news from my standpoint is that I didn't find as many
generalized components as I had hoped.

I would appreciate help with one issue I'm running into.  It seems to
me that the pkinit reply does not actually sign anything in the KDC
reply.  Is this true?  You end up getting a signed copy of the reply
key, but not really any verification of the other parts of the
request.

It seems like we should look at what unauthenticated plaintext issues
pkinit has.  I don't think I can see any particular protocol flaws,
but it does seem like the security considerations section needs to be
expanded to address these issues.

---

From: Brian Tung <[email-masked]>
Date: Sat, 8 Nov 2003 17:07:20 -0800

> key, but not really any verification of the other parts of the

That's right, I think.

> expanded to address these issues.

It seems to me that it's unlikely to cause any protocol flaws, since
anything that's unauthenticated in PKINIT would have to be unauthenticated
in ordinary Kerberos, too.  Do you think there's any low-lying fruit to
be gathered by signing the reply in addition to the reply key?

Brian Tung <[email-masked]>