Subject: I-D ACTION:draft-ietf-cat-kerberos-pk-init-17.txt

From: [email-masked]
Date: Mon, 24 Nov 2003 15:33:39 -0500

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Kerberos WG Working Group of the IETF.

	Title		: Public Key Cryptography for Initial Authentication in Kerberos
	Author(s)	: B. Tung, C. Neuman, M. Hur, A. Medvinsky, S. Medvinsky, J. Wray, J. Trostle
	Filename	: draft-ietf-cat-kerberos-pk-init-17.txt
	Pages		: 18
	Date		: 2003-11-24
	
This draft describes protocol extensions (hereafter called PKINIT)
to the Kerberos protocol specification (RFC 1510bis [1]).  These
extensions provide a method for integrating public key cryptography
into the initial authentication exchange, by passing cryptographic
certificates and associated authenticators in preauthentication data
fields.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-cat-kerberos-pk-init-17.txt

To remove yourself from the IETF Announcement list, send a message to 
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-cat-kerberos-pk-init-17.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-cat-kerberos-pk-init-17.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Love <[email-masked]>
Date: Tue, 25 Nov 2003 01:08:47 +0100

> 	Filename	: draft-ietf-cat-kerberos-pk-init-17.txt

-17 comments:

	Why was fields reorderd/tag changed in TrustedCas ? Couldn't it just have
	dropped.

	SubjectPublicKeyInfo and AlgorithmIdentifier is still inlined

	What was the idea how non des3 enctype should derive they session key from
	the DH exchange ? Using kcrypto's random-to-key after simplified profile
	associated (unkeyed) hash over DH secret key (and something
	else ?)

	should enctype be added for acceptance of id-aes128-CBC, id-aes256-CBC
	(rfc3565) as part of EncryptedContentInfo for CMS messsages ?

Love

---

From: Sam Hartman <[email-masked]>
Date: Wed, 26 Nov 2003 14:16:48 -0500

>>>>> "Love" == Love  <[email-masked]> writes:

    Love> [email-masked] writes:

    >> Title : Public Key Cryptography for Initial Authentication in
    >> Kerberos Filename : draft-ietf-cat-kerberos-pk-init-17.txt

    Love> -17 comments:
    Love> 	SubjectPublicKeyInfo and AlgorithmIdentifier is still
    Love> inlined

What would you do instead?

    Love> 	What was the idea how non des3 enctype should derive
    Love> they session key from the DH exchange ? Using kcrypto's
    Love> random-to-key after simplified profile associated (unkeyed)
    Love> hash over DH secret key (and something else ?)

Why would you use a hash?  Just random to key over the output of DH
should be sufficient and avoids depending on a particular hash.  You
should be able to show fairly easily that assuming at least one side
chooses a random x or y, g^(xy) will be a random member of the group.