Subject: PKINIT status

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 16 Dec 2003 11:43:28 -0500 (EST)

During the IETF meeting in Minneapolis, Doug and I met with the PKINIT
document editor (Brian Tung) and several contributors, to review the
status of open issues relating to PKINIT.  There were no design issues on
the table; the purpose of this meeting was entirely to review the work
status and make sure we were still on track.

During that meeting, we agreed to the following milestones for PKINIT:

NOV 21  - submit pkinit-17
JAN 12  - submit pkinit-18 with all updates above
MAR     - WG last call

draft-ietf-cat-kerberos-pk-init-17.txt was published on Nov 24.

As of the meeting in Minneapolis, the following issues had been resolved,
and text sent to the editor by the responsible individuals:

++ REMOVE use of raw public keys [editor]
++ REMOVE name transformation [editor]
++ REMOVE principal name as trusted-CA [editor]
++ Internationalization of strings [Jeff Altman]
++ Extensibility [Jeff Hutzelman]
++ Confirm alignment with CMS [Todd Stecher/Microsoft]
++ initial flag issue [initial flag SET for pkinit; confirm on list]

The last issue relates to the setting of the 'initial' flag in tickets
issued via AS_REQ/AS_REP exchanges using PKINIT.  I will be making a call
for concensus on this issue in a separate message.

The following items remained still to be done; work assignments and due
dates are indicated in brackets:

-- specify subjectAltName for user cert
   [tlyu, jaltman, editor; update at ietf58 meeting]

-- refactoring preauth
   [Sam Hartman; status update at ietf58 meeting]

-- Confirm alignment with kcrypto
   [Sasha Medvinsky; commented on list; ping again 19-Nov-2003]

-- transited CA's AUTH-DATA
   [bcn, Nico Williams; text to brian by 17-Dec-2003]

-- OCSP and optional revocation information
   [Microsoft, by 20-Dec-2003]

-- Security of cached DH values and use of a nonce
   [Microsoft, by 20-Dec-2003]

-- Confirm alignment with kerberos-clarifications
   [Nico Williams; 20-Dec-2003]

-- Update PA types
   [Cliff Neuman + editor; last]

I am in the process of collecting updated status information on these
items, and will post a summary to the list later this week...

-- Jeff