Subject: [Ietf-krb-wg] I-D Action: draft-ietf-krb-wg-pkinit-alg-agility-05.txt

From: [email-masked]
Date: Fri, 06 Jan 2012 04:46:04 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kerberos Working Group of the IETF.

	Title           : PKINIT Algorithm Agility
	Author(s)       : Love Hornquist Astrand
                          Larry Zhu
                          Margaret Wasserman
	Filename        : draft-ietf-krb-wg-pkinit-alg-agility-05.txt
	Pages           : 17
	Date            : 2012-01-06

   This document updates PKINIT, as defined in RFC 4556, to remove
   protocol structures tied to specific cryptographic algorithms.  The
   PKINIT key derivation function is made negotiable, the digest
   algorithms for signing the pre-authentication data and the client's
   X.509 certificates are made discoverable.

   These changes provide preemptive protection against vulnerabilities
   discovered in the future against any specific cryptographic
   algorithm, and allow incremental deployment of newer algorithms.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-pkinit-alg-agility-05.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-krb-wg-pkinit-alg-agility-05.txt

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Margaret Wasserman <[email-masked]>
Date: Fri, 6 Jan 2012 16:57:55 -0500

Just FYI --

Changes in this latest version of this document include:

- Removed the ticket from the PkinitSuppPubInfo structure
- Fixed an error in the description of the KDF inputs (pub and priv swapped)
- Updated and expanded the test vectors
- Made various editorial changes to correct errors and improve clarity and consistency

Please review the new document, and share any feedback on the WG list.

Thanks,
Margaret

---

From: Sam Hartman <[email-masked]>
Date: Tue, 10 Jan 2012 09:09:10 -0500

What's the path to last calling this?
Obviously as you mentioned, the first step is  to seek review comments
on the list.
But what after that?
Are there other changes you believe need to be made or should we ask
Jeff to consider this document for last call after resolving any
comments that come up?

--Sam