Subject: Re: [Ietf-krb-wg] review of draft-zhu-pku2u-03

From: Larry Zhu <[email-masked]>
Date: Sat, 26 Jan 2008 16:12:03 -0800

Leif Johansson wrote:

> First of all I think the normative language in the draft SHOULD be
> rephrased to be normative using the language of 2119 throughout.

Sure, I gave it a pass and did some changes accordingly. Please let me know if you believe additional changes are required for -04 when that is published.

> The only major problem I have with the draft is that it claims to
> provide a mechanism for user-to-user communication which does
> not require a trusted third party. This is only true in the sense
> that a KDC isn't required. The draft either requires a CA to issue
> certificates or an entity which in some other way guarantees
> name-key-binding. That entity by definition constitutes a trusted
> third party. I suggest changing the introduction to something like:

> "This mechanism provides security services in peer to peer
> networking environments without requiring a Key Distribution
> Center (KDC) and can act as a bridge between PKI and GSS-API
> for such environments."

Sure, I made the changes based on your suggestions. It is however important to point out that PKU2U does work when there is no PKI, the peer can maintain the bindings without using certificates/PKI directly.

> This language is difficult to read to me. First there seems to be an
> extra "and" in "and prior to" (both in the ASN. comment and in the
> text). I'm not sure If I understand this but is this what you mean?

> "The gss-mic field contains a checksum of all the GSS-API tokens sent
> from the initiator to the acceptor in the order they were sent, prior
> to the current token."

Yes, in this case we went overboard fully-qualifying the sentence and it ends up hurting the clarity.
I rephrased the text per your suggestion and you should see the changes reflected in -04.

Thanks,

--larry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Leif Johansson
Sent: Saturday, December 08, 2007 3:55 PM
To: [email-masked]
Subject: [Ietf-krb-wg] review of draft-zhu-pku2u-03

Hello Larry and Jeffrey,

I have reviewed this draft. These are my comments that have nothing
to do with the naming-issues discussed elsewhere.

First of all I think the normative language in the draft SHOULD be
rephrased to be normative using the language of 2119 throughout.

The only major problem I have with the draft is that it claims to
provide a mechanism for user-to-user communication which does
not require a trusted third party. This is only true in the sense
that a KDC isn't required. The draft either requires a CA to issue
certificates or an entity which in some other way guarantees
name-key-binding. That entity by definition constitutes a trusted
third party. I suggest changing the introduction to something like:

"This mechanism provides security services in peer to peer
networking environments without requiring a Key Distribution
Center (KDC) and can act as a bridge between PKI and GSS-API
for such environments."

Finally a minor nit in the last paragraph of section 6:

"The gss-mic field in the KRB-FINISHED structure contains a checksum
of all the GSS-API tokens exchanged between the initiator and the
acceptor, and prior to the GSS-API token containing the AP-REQ
[RFC4120].  This checksum is performed over these GSS-API tokens in
the order that the tokens were sent."

This language is difficult to read to me. First there seems to be an
extra "and" in "and prior to" (both in the ASN. comment and in the
text). I'm not sure If I understand this but is this what you mean?

"The gss-mic field contains a checksum of all the GSS-API tokens sent
from the initiator to the acceptor in the order they were sent, prior
to the current token."

    Cheers Leif
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg