Subject: Re: pkinit and dh->key

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 08 Jan 2004 20:17:55 -0500

On Thursday, January 08, 2004 15:54:31 -0500 Sam Hartman <[email-masked]> 
wrote:

> We're approaching the point at which we wanted to have a final pkinit
> draft.  I think the issue of how to handle getting from a DH value to
> a key is still open.  What do we need to do to close that issue?

That was not on my open issues list, but it is now.  My open-issues list 
currently looks something like this:

OPEN ISSUES:
-- specify subjectAltName for user cert
   [tlyu, jaltman, editor; update at ietf58 meeting]

-- refactoring preauth
   [Sam Hartman; status update at ietf58 meeting]

-- Confirm alignment with kcrypto
   [Sasha Medvinsky; commented on list; ping again 19-Nov-2003]

-- Confirm alignment with kerberos-clarifications
   [Nico Williams; 20-Dec-2003]

-- How to transform DH shared secret into a key
   [???]

-- Update PA types
   [Cliff Neuman + editor; last]

CLOSED ISSUES:
++ REMOVE use of raw public keys [editor]
++ REMOVE name transformation [editor]
++ REMOVE principal name as trusted-CA [editor]
++ Internationalization of strings [Jeff Altman]
++ Extensibility [Jeff Hutzelman]
++ Confirm alignment with CMS [Todd Stecher/Microsoft]
++ initial flag issue [initial flag SET for pkinit; confirmed on list]
++ transited CA's AUTH-DATA [bcn, Nico Williams]
++ OCSP and optional revocation information [JK]
++ Security of cached DH values and use of a nonce [JK]

---

From: Brian Tung <[email-masked]>
Date: Thu, 8 Jan 2004 13:10:31 -0800

With all the stuff coming in last minute, the revised draft is going to
be somewhat delayed.

Brian Tung <[email-masked]>

---

From: [email-masked] (Sam Hartman)
Date: Thu, 8 Jan 2004 15:54:31 -0500 (EST)

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 8 Jan 2004 14:52:09 -0600

> a key is still open.  What do we need to do to close that issue?

And I owe one item too.