Subject: RE: PKINIT open issues

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 2 Jun 2004 11:39:00 -0700

Sam Hartman wrote:

> I do not know how I feel about inevitable comments
> delay of the spec or interoperability.

I do not know a consensus can be reached if we enforce restrictions on
the encoding to the CMS objects.

I did not think interoperability (between what?) was possible here;
otherwise, this draft is not close to be finalized.

On the other hand, a new section on interoperability should be helpful.

Thanks,

Larry

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Wednesday, June 02, 2004 11:09 AM
To: Love
Cc: Liqiang(Larry) Zhu; Nicolas Williams; D. R. Evans;
[email-masked]
Subject: Re: PKINIT open issues

>>>>> "Love" == Love  <[email-masked]> writes:

    Love> "Liqiang(Larry) Zhu" <[email-masked]> writes:

    >>  Nicolas Williams wrote:
    >>> IMO, wherever Kerberos V or Kerberos extensions like PKINIT
    >>> have OCTET
    >> STRINGs (or BIT STRINGs even)
    >>> containing non-Kerberos data then the encoding of their
    >>> content is
    >> controlled by the specification of that
    >>> content, whatever it is.  PKINIT does not have any such OCTET
    >>> STRINGs or BIT STRINGs,
    >>  I am trying to catch up on this and I did not see any further
    >> thoughts on this idea.
    >> 
    >> I think it is a fine idea to specify the CMS objects as OCTET
    >> strings. I do not know how, otherwise, one can use existing CMS
    >> libraries for the PKINIT messages. This way we can also
    >> abstract better the CMS objects.

    Love> I'm doing that by misuse of ANY. I pointed this problem in
    Love> minneapolis (I think it was there), but it was rejected that
    Love> it would delay (haha) the pkinit draft.

I agree with Love and Larry that the CMS objects should be
octet-strings.  I do not know how I feel about inevitable comments about
delay of the spec or interoperability.  I do know that we have two of
the three vendors who have come forward on this list claiming that the
feature is important to use existing CMS libraries.

--Sam

---

From: Love <[email-masked]>
Date: Wed, 02 Jun 2004 21:13:54 +0200

> the encoding to the CMS objects.

I think we should recomend DER, but it all depends on if its possible to
tweek the CMS lib the implementor is using.

> otherwise, this draft is not close to be finalized.

Lets wrap all cms types with "[N] IMPLICIT OCTET STRING".

> On the other hand, a new section on interoperability should be helpful.

I can add my notes on interoperability if we just can complete this
document some more, so I know what to be interropable with :)

Love

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 2 Jun 2004 14:55:50 -0500

> otherwise, this draft is not close to be finalized.

Good point.  Given what we had before (implicitly forcing DER on CMS) it
isn't clear that PKINIT could have been implemented with off-the-shelf
components, and perhaps not interoperably, particularly given Love's
note about abusing ANY to avoid forcing the use of DER on CMS.

So, though Larry's proposal might break interop with old PKINIT
implementations, it seems justifiable and even necessary to do it.

> On the other hand, a new section on interoperability should be helpful.

Yes, but I'm afraid we won't think up every issue.

Nico
--