Subject: [KEYPROV] Proposal for common key properties within a single (PSKC) KeyContainer

From: "Philip Hoyer" <[email-masked]>
Date: Thu, 17 Apr 2008 16:48:26 +0200

Ladies and Gentlemen,

Please find attached a schema for the proposal of common key properties
across a single(PSKC) container.

The proposal is to allow the creation of a common set of data value for
a single key that can be referenced by multiple key instances within a
carried container.

When I developed the proposal I thought it would be a good thing to
allow this as an option and to maintain compatibility with the current
version of the spec.

I hence propose the creation of a new entity tentatively called
'KeyProperties'

This can harbour MOST of the data you will find in a Key except KeyId
(which must be unique to the instance of the key) and KeyFriendlyName
(again I see this as something that is unique to the instance but we can
argue about this one).

The concept here is that at KeyContainer level one can define as many
KeyProperties as one wants and they are uniquely referenced via a
KeyPropertiesId.

We then add an optional KeyPropertiesId attribute to the KeyType.

Hence:

If a Key instance has an attribute of  KeyPropertiesId set:

1.	All values set in the KeyProperties should be used
2.	If a value of a specific element is set both in the
KeyProperties element and in the Key element the Key element would take
precedence.

So it is possible to keep our first example of a non encrypted HOTP
secret:

   <?xml version="1.0" encoding="UTF-8"?>

   <KeyContainer Version="1.0"

     xmlns="urn:ietf:params:xml:ns:keyprov:container:1.0">

       <Device>

           <DeviceId>

               <Manufacturer>ACME</Manufacturer>

               <SerialNo>0755225266</SerialNo>

           </DeviceId>

           <Key KeyAlgorithm="http://www.ietf.org/keyprov/pskc#hotp"

             KeyId="0755225266">

               <Issuer>AnIssuer</Issuer>

               <Usage OTP="true">

                   <ResponseFormat Length="6" Format="DECIMAL"/>

               </Usage>

               <Data Name="COUNTER">

                   <PlainValue>AprkuA==</PlainValue>

               </Data>

               <Data Name="SECRET">

                   <PlainValue>/4h3rOTeBegJwGpmTTq4F+RlNR0=</PlainValue>

               </Data>

               <ExpiryDate>2012-12-31T00:00:00</ExpiryDate>

           </Key>

       </Device>

   </KeyContainer>

But also if one wanted use KeyProperties and it would become as follows:

   <?xml version="1.0" encoding="UTF-8"?>

   <KeyContainer Version="1.0"

     xmlns="urn:ietf:params:xml:ns:keyprov:container:1.0">

           <KeyProperties KeyPropertiesId="00000001"
KeyAlgorithm="http://www.ietf.org/keyprov/pskc#hotp">

               <Issuer>AnIssuer</Issuer>

               <Usage OTP="true">

                   <ResponseFormat Length="6" Format="DECIMAL"/>

               </Usage>

               <Data Name="COUNTER">

                   <PlainValue>AprkuA==</PlainValue>

               </Data>

               <ExpiryDate>2012-12-31T00:00:00</ExpiryDate>

           </KeyProperties>

       <Device>

           <DeviceId>

               <Manufacturer>ACME</Manufacturer>

               <SerialNo>0755225266</SerialNo>

           </DeviceId>

           <Key KeyPropertiesId="00000001" KeyId="0755225266">

               <Data Name="SECRET">

                   <PlainValue>/4h3rOTeBegJwGpmTTq4F+RlNR0=</PlainValue>

               </Data>

           </Key>

       </Device>

   </KeyContainer>

The last version is especially useful for bulk provisioning where
multiple keys can then share the same common properties eg in a
fragment:

           <Key KeyPropertiesId="00000001" KeyId="0755225266">

               <Data Name="SECRET">

                   <PlainValue>/4h3rOTeBegJwGpmTTq4F+RlNR0=</PlainValue>

               </Data>

           </Key>

           <Key KeyPropertiesId="00000001" KeyId="0755225267">

               <Data Name="SECRET">

                   <PlainValue>/4h3rOTeBegJwGpmTTq4F+RlNR0=</PlainValue>

               </Data>

           </Key>

            ....

To achieve that the KeyProperties elements and the Key elemnts are
exactly aligned I created an XML schema base type called KeyBase that
harbours the common parts:

            <xs:complexType name="KeyBaseType" abstract="true">

                        <xs:sequence>

                                    <xs:element name="Issuer"
type="xs:string" minOccurs="0"/>

                                    <xs:element name="Usage"
type="pskc:UsageType"/>

                                    <xs:element name="KeyProfileId"
type="xs:string" minOccurs="0"/>

                                    <xs:element name="MasterKeyLabel"
type="xs:string" minOccurs="0"/>

                                    <xs:element name="Data"
type="pskc:DataType" minOccurs="0" maxOccurs="unbounded"/>

                                    <xs:element name="PINPolicy"
type="pskc:PINPolicyType" minOccurs="0"/>

                                    <xs:element name="ExpiryDate"
type="xs:dateTime" minOccurs="0"/>

                                    <xs:element name="StartDate"
type="xs:dateTime" minOccurs="0"/>

                                    <xs:element name="FriendlyName"
type="xs:string" minOccurs="0"/>

                        </xs:sequence>

                        <xs:attribute name="KeyAlgorithm"
type="pskc:KeyAlgorithmType" use="required"/>

            </xs:complexType>

And then both KeyType and KeyProperties Type extend this and make the
relevant Ids required or optional:

            <xs:complexType name="KeyType">

                        <xs:complexContent>

                                    <xs:extension
base="pskc:KeyBaseType">

                                                <xs:attribute
name="KeyId" type="xs:string" use="required"/>

                                                <xs:attribute
name="KeyPropertiesId" type="xs:string" use="optional"/>

                                    </xs:extension>

                        </xs:complexContent>

            </xs:complexType>

            <xs:complexType name="KeyPropertiesType">

                        <xs:complexContent>

                                    <xs:extension
base="pskc:KeyBaseType">

                                                <xs:attribute
name="KeyPropertiesId" type="xs:string" use="required"/>

                                    </xs:extension>

                        </xs:complexContent>

            </xs:complexType>

Alternatively we could just copy the KeyType into a new ComplexType
called KeyProperties.

Thoughts are welcome,

Philip

________________________________

Philip Hoyer 

Senior Architect - Office of CTO

ActivIdentity (UK)

109 Borough High Street

London SE1 1NL

Telephone: +44 (0) 20 7744 6248

Direct: +44 (0) 20 7744 6455

Fax: +44 (0) 20 7744 6249

Private and confidential: This message and any attachments may contain

privileged / confidential information. If you are not an intended
recipient,

you must not copy, distribute, discuss or take any action in reliance on
it.

If you have received this communication in error, please notify the
sender

and delete this message immediately.

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov