Subject: [Ietf-krb-wg] Review of draft-ietf-krb-wg-pkinit-alg-agility-06

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 09 Mar 2012 21:53:00 -0500

Below is my review of the PKINIT hash agility document.  I found no
technical issues with this document, but there are a few issues that
need to be resolved.  As always, I'd prefer to get responses to
everything, but the first five items are blockers and must be resolved
before the document can progress.  In the case of point 3, only the
first part (verifying assignments in non-IANA registries) is blocking;
I'll leave it to the authors to use their judgment in determining
whether any changes need to be made to the document.

I need someone to validate the ASN.1 module in Appendix A.

I would also like to hear from anyone who has implemented this
specification or is planning to do so, and particularly from anyone who
was able to verify the test vectors in section 7.

-- Jeff

1) This document updates RFC4556; it needs a header to that effect.

2) The document seems to lack a disclaimer for pre-RFC5378 work, but was
   first submitted before 10 November 2008.  Should you add the disclaimer?
   (See the Legal Provisions document at http://trustee.ietf.org/license-info
   for more information.)

3) This document assigns the following values, drawn from registries
   not yet managed by IANA.  Please confirm that these values have
   actually been assigned and are correct:

   - id-pkinit-kdc OID arc (id-pkinit 6)
   - Error type KDC_ERR_NO_ACCEPTABLE_KDF (82)

   It may be desirable to include a "Number Assignments" section describing
   these assignments, as was done in referrals.

   Also, this document uses some values which were previously reserved
   for it in an IANA-managed registry.  It may be useful to include an
   IANA considerations section indicating this, so IANA knows to update
   the registry to refer to the published RFC.

4) The following acronyms must be expanded on first use:
   - KDC (section 1, last graf)
   - CA (section 5, graf 1)

5) The following references are obsolete:
  - RFC 1320 (Obsoleted by RFC 6150)
  - RFC 3280 (Obsoleted by RFC 5280)
  - RFC 3852 (Obsoleted by RFC 5652)
  - RFC 4634 (Obsoleted by RFC 6234)

6) Are RFC3766 and RFC6194 really normative references for this document?

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tom Yu <[email-masked]>
Date: Wed, 21 Mar 2012 08:03:54 -0400

>    - id-pkinit-kdc OID arc (id-pkinit 6)

There is no known conflict for this OID, but I had not recorded it
yet.  The ASN.1 module in Appendix A defines neither this OID nor its
children.  It possibly should, while also mentioning that they are
used as RFC 3280 AlgorithmIdentifier OIDs, and that they have no
associated parameters when used as such.

>    - Error type KDC_ERR_NO_ACCEPTABLE_KDF (82)

There is no known conflict for this error code, and I have recorded it
earlier.  It does not appear in the ASN.1 module, but we have tended
not to use ASN.1 to define error code assignments (unlike for preauth
and typed-data numbers).

Additionally, I already recorded the following assignments:

   TD-CMS-DIGEST-ALGORITHMS ::= INTEGER 111
   TD-CERT-DIGEST-ALGORITHMS ::= INTEGER 112

though to be syntactically correct ASN.1, they should be:

   td-cms-digest-algorithms     INTEGER ::= 111
   td-cert-digest-algorithms    INTEGER ::= 112

They also do not appear in the ASN.1 module.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Wed, 21 Mar 2012 17:17:29 -0400

>>>>> "Tom" == Tom Yu <[email-masked]> writes:

    Tom> Additionally, I already recorded the following assignments:

    Tom>    TD-CMS-DIGEST-ALGORITHMS ::= INTEGER 111
    Tom> TD-CERT-DIGEST-ALGORITHMS ::= INTEGER 112

You don't control that registry any more.
RFc 6113 turns typed data and preauth types over to IANA.
So, should we update IANA considerations here?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 21 Mar 2012 17:31:36 -0400

> So, should we update IANA considerations here?

Yes; I mentioned this in my review:

-- Jeff

---

From: Margaret Wasserman <[email-masked]>
Date: Sat, 24 Mar 2012 12:06:32 -0400

Hi Jeff,

Thanks for the review.  All of your comments look reasonable, and I will publish and updated document to address these issues as soon as possible.

Margaret

---

From: Sam Hartman <[email-masked]>
Date: Sun, 25 Mar 2012 02:50:38 -0400

>>>>> "Margaret" == Margaret Wasserman <[email-masked]> writes:

    Margaret> Hi Jeff,

    Margaret> Thanks for the review.  All of your comments look
    Margaret> reasonable, and I will publish and updated document to
    Margaret> address these issues as soon as possible.

I'm speaking as an individual here, although I'm related a conversation
Jeff and I had where Jeff was in a chair role.

For the record, I'd like to note that Jeff and I have had an offline
discussion and we'd prefer not to introduce a number assignments section
into pkinit-alg-agility.
We still believe an IANA considerations section for IANA-managed values
is required.
So, you should disregard that comment.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg