Subject: RE: PKINIT open issues

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 19 Apr 2004 20:33:32 -0700

Jeffrey Hutzelman wrote:
> -- Open issues on DH key exchanges
>    I have seen no traffic on this in several days.  I need a volunteer to
>   take responsibility for researching and resolving this issue.

I volunteer, and will report back to the working group.

larry

________________________________

From: [email-masked] on behalf of Jeffrey Hutzelman
Sent: Mon 4/19/2004 2:34 PM
To: [email-masked]
Subject: PKINIT open issues

These are the open issues I currently have for PKINIT.  This document was
to go to the IESG last month, and it's still not done.  I'd like to see
these issues resolved in the next few days (perhaps some already have been):

-- specify subjectAltName for user cert [tlyu, jaltman, editor]
   Can someone please tell me what this means, and if it is done?

-- Update PA types [Cliff Neuman + editor; last]
   Brian and Cliff should get together and make sure new types are
   assigned and appear in the -20 version of the document.  I would
   like to be able to last-call -20 when it appears...

-- ASN.1 errata - wrong module import for PKIX
-- ASN.1 errata - incorrect/multiple import statements
-- ASN.1 errata - subjectAltName definition
   Have these been fixed?

-- ASN.1 module appendix
   This is probably a good idea.  I'd like to see an ASN.1 module
   appendix in the next version of the draft.  Brian, can you do this,
   or do you need help?

-- OCSP tunneling:
   Eric objects to including this in PKINIT, and suggested moving it to a
   separate draft.  It appears that Sam agrees this would be acceptable.
   I've seen no comment from anyone at Microsoft on this issue, nor from
   anyone else.

     Does anyone object to moving this work to a separate draft?
     Does anyone care enough about this to volunteer to edit a draft?

   Depending on the answers to these questions, and on the ensuing
   discussion, we will either drop the OCSP tunneling entirely, move
   it to a separate draft, or keep it in PKINIT.

-- AD-INITIAL-VERIFIED-CAs
   Nico provided text defining this AD type, to address the problem of
   being able to tell whether PKINIT was used to obtain a ticket and,
   if so, what CA's were involved.  This problem was discussed in some
   detail, along with some proposed solutions.

   Sam and Nico both believe that this data must be REQUIRED, since it
   plays a role analogous to that played by the transited-realms field,
   providing information about the entities involved in the authentication
   process which may be used by servers in making authorization decisions.
   Eric objects to making this data REQUIRED.

   I need to see the following:
   - Comments from Eric on why he wants to be able to omit this data.
   - Comments from Eric on why he believes that being able to omit this
     data does not adversely affect the security properties of the
     protocol.
   - Comments from the rest of the WG on any aspect of this issue, and
     especially on whether they support or oppose making this data
     REQUIRED.

-- Open issues on DH key exchanges
   I have seen no traffic on this in several days.  I need a volunteer to
   take responsibility for researching and resolving this issue.

-- Love's comments on PA-PK-AS-REP and similar types.

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Co-chair, IETF Kerberos Working Group
   Carnegie Mellon University - Pittsburgh, PA

---

From: Sam Hartman <[email-masked]>
Date: Tue, 20 Apr 2004 13:31:01 -0400

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    Liqiang(Larry)> Jeffrey Hutzelman wrote:
    >> -- Open issues on DH key exchanges I have seen no traffic on
    >> this in several days.  I need a volunteer to take
    >> responsibility for researching and resolving this issue.

    Liqiang(Larry)> I volunteer, and will report back to the working
    Liqiang(Larry)> group.

Here are some concrete questions that may help your research:

* How much information is lost by the DH exchange.  I.E.  what is the
  cardinality of (g^x)^y mod p?  I believe the answer is approximately
  1/2 to 1/4 the size of p for well-chosen p.

* What is the distribution of (g^x)^y mod p?  I don't know, but I
  suspect that the cardinality is sufficiently high that the
  distribution is not horrible.

* Is b(g^x)^y mod p a random element of the set of all possible
  (g^x)^y mod p assuming a good generator g and good prime p, random x
  and random y?  I believe the answer is trivially yes.

I realize I'm being incredibly sloppy in the above.  I could be
significantly less sloppy, but I believe doing so would focus the
discussion on the details of my questions rather than on the
information the WG needs in order to evaluate whether DH truncation is
acceptable.