Subject: Re: [Ietf-krb-wg] With moderate speed: resolving channels and anonymous pkinit

From: Sam Hartman <[email-masked]>
Date: Thu, 29 Oct 2009 15:14:14 -0400

>>>>> "Love" == Love Hörnquist Åstrand <[email-masked]> writes:

    Love>     I'm notsure what the nonces bring to this.  It semes
    Love> like if you use the DH key to generate the session key, then
    Love> you're fine.  The challenge is making it possible for the
    Love> client to prove that happened.

    Love> Why is there a challange ? just have the client generate the
    Love> same key and verify they are the same.

I'm going to be implementing anonymous pkinit shortly.

My plan is to implement what is in draft 10.  However I agree that
Love's approach is cleaner.  If someone wants to write up a proposal
to generate the session key from the DH key that:

1) Works on top of RFC 4556

2) works on top of pkinit plus hash agility

3) Works with and without nonces in the DH caching sense

then I'd be happy to go with that.

Actually, such a proposal might be easy: it might be as simple as take the reply key and run it through RFC 3961 PRF to generate the session key.

I *think* the reply key is already fresh all the time, so the session
key would still be fresh.

If it's really that simple, I'd love to take that approach for
anonymous pkinit.  However, I'd like to work with someone to go
through the details and confirm it is safe to do so.  If we cannot
complete a design, get it to the WG list and get some positive
comments by end of IETf week, I'll go forward with what's in -10.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg