Subject: CAT-WG Last-Call: pk-init-07 and pk-cross-05

From: "Linn, John" <[email-masked]>
Date: Mon, 16 Nov 1998 13:13:18 -0500

This message is to open a CAT-WG Last-Call, to extend through Wednesday, 2
December, on the recently resubmitted pk-init-07 and pk-cross-05
Internet-Drafts as potential candidates for WG recommendation to become
Proposed Standards.  WG discussion at the Chicago meeting specifically
anticipated a WG Last-Call on pk-init, following changes which have been
incorporated into the -07 version.  WG Last-Call for pk-cross was not
specifically discussed at the Chicago meeting.  My understanding, however,
is that no changes are currently pending or planned for pk-cross, and that
its advancement consideration is pending on pk-init, on which it depends; in
the interests of efficiency, therefore, I'll propose that both documents be
considered within the same WG Last-Call.  If there's objection to this
approach, please make it known to the list for discussion and we can
consider narrowing this WG Last-Call to pk-init alone.

--jl

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: "Linn, John" <[email-masked]>
Date: Mon, 23 Nov 1998 14:50:44 -0500

To this point, Tom Yu and Ted Ts'o have submitted comments noting that
pk-cross-05 is dependent on a contentious feature within kerberos-revisions.
It appears, therefore, that pk-cross cannot advance before
kerberos-revisions, and that the contentious issue within kerberos-revisions
needs to be resolved before kerberos-revisions can advance.  Given these
premises, it seems to me that the following topics need to be addressed with
respect to this set of documents:

(1) reconciliation of the kerberos-revisions ticket extension issue

(2) ongoing WG Last-Call review of pk-init-07

(3) ongoing WG Last-Call review of aspects of pk-cross-05 unrelated to the
use of kerberos-revisions' ticket extension facility.

Further comments or discussion, anyone?

--jl

> ----------
> From: 	Linn, John[SMTP:[email-masked]]
> Sent: 	Monday, November 16, 1998 1:33 PM
> To: 	'CAT-WG List'; Linn, John
> Subject: 	RE: CAT-WG Last-Call: pk-init-07 and pk-cross-05
> 
> I'll open the discussion with a pair of related questions: 
> 
> - do these drafts have known dependencies on changes which
> kerberos-revisions makes relative to RFC-1510, and/or 
> 
> - do any anticipated modifications to be made in kerberos-revisions impact
> these drafts?
> 
> --jl
> 
> > ----------
> > From: 	Linn, John
> > Sent: 	Monday, November 16, 1998 1:13 PM
> > To: 	'CAT-WG List'
> > Subject: 	CAT-WG Last-Call: pk-init-07 and pk-cross-05
> > 
> > its advancement consideration is pending on pk-init, on which it
> depends;
> > in the interests of efficiency, therefore, I'll propose that both
> > documents be considered within the same WG Last-Call.  If there's
> > objection to this approach, please make it known to the list for
> > discussion and we can consider narrowing this WG Last-Call to pk-init
> > alone.
> > 
> > --jl
> > 
> > 
> > 
> >

---

From: David Hemsath <[email-masked]>
Date: Tue, 24 Nov 1998 15:33:08 -0500

---------------------- Forwarded by David Hemsath/Austin/IBM on 11/24/98 06:16
AM ---------------------------

David Hemsath
11/23/98 10:31 PM
To: [email-masked]
cc:
From: David Hemsath/Austin/IBM@ibmus
Subject: RE: CAT-WG Last-Call: pk-init-07 and pk-cross-05

I have a (repeat) comment on pk-init-07.  Starting at line 575 of the current
I-D:

>The EnvelopedKeyPack data type below contains an encrypted
>temporary key (either with the PKINIT client's public key or with a
>symmetric key, resulting from the Diffie-Hellman exchange). It also
>contains a signed and encrypted reply key. This data structure is
>similar to EnvelopedData, defined in CMS [11] and PKCS #7 [12].

I'm co-author of The Open Group's DCE RFC 68.4, which uses pk-init as the basis
for certificate-based login to DCE.  What I'd prefer, in place of "similar to
...
CMS" is the actual use of the CMS I-D from the S/MIME work group.  Other IETF
efforts (e.g., PKIX) have seen fit to build upon the CMS I-D.  The use of
CMS within pk-init would make it more straightforward to implement pk-init using
the available S/MIME toolkits out there to build/consume CMS Signed and
EnvelopedData.  Alternatively, the PKIX reference implementation or the S/MIME
Freeware Library (SFL) could be used as the basis for CMS
production/consumption.
I do not see a compelling reason for pk-init to define something so close, but
different from CMS.

P.S. I wasn't at the 41st IETF, but I'd heard that a Microsoft employee had
     advocated the use of CMS w/i pk-init as well.  Since both DCE and
     Windows 2000 are in the process of implementing pk-init, I hope that
     Microsoft will post their thoughts on this as well.

---

From: Brian Tung <[email-masked]>
Date: Tue, 24 Nov 1998 13:36:30 -0800 (PST)

PKINIT does actually copy in the CMS data structures in.  It should
interoperate with any ASN.1 generater/parser that works through a
CMS-compliant API (of the version cited in the draft).  The reason
why they were copied in "by value" rather than "by reference" is
that we couldn't get any assurance that CMS wouldn't be a moving
target.  If CMS were to change, that would clearly present a problem
for PKINIT implementations.  This issue has been raised and this
objection pointed out in previous CAT meetings.

The wording "similar to" is misleading, I will admit.  Probably it
ought to be changed, to reflect that the data structures are identical,
except for the name.

b