Subject: Re: I-D ACTION:draft-ietf-cat-kerberos-pk-init-17.txt

From: Love <[email-masked]>
Date: Thu, 04 Dec 2003 10:31:04 +0100

Sam Hartman <[email-masked]> writes:

>>>>>> "Love" == Love  <[email-masked]> writes:
>
>     Love> [email-masked] writes:
>
>     >> Title : Public Key Cryptography for Initial Authentication in
>     >> Kerberos Filename : draft-ietf-cat-kerberos-pk-init-17.txt
>
>     Love> -17 comments:
>     Love> 	SubjectPublicKeyInfo and AlgorithmIdentifier is still
>     Love> inlined
>
> What would you do instead?

They are copied from x509/rfc2459bis, add a reference.

>     Love> 	What was the idea how non des3 enctype should derive
>     Love> they session key from the DH exchange ? Using kcrypto's
>     Love> random-to-key after simplified profile associated (unkeyed)
>     Love> hash over DH secret key (and something else ?)
>
> Why would you use a hash?  Just random to key over the output of DH
> should be sufficient and avoids depending on a particular hash.  You
> should be able to show fairly easily that assuming at least one side
> chooses a random x or y, g^(xy) will be a random member of the group.

I've have been thinking on how to put but concern into words, but have so
far failed. The easiest way out it to say; "Its not how its done in CMS
(see rfc2631)".

Love