Subject: [KEYPROV] DSKPP-client-side authentication

From: <[email-masked]>
Date: Sun, 25 Jan 2009 19:55:48 -0500

Okay, by doing the following:

1. Remove reference to Client certificate/key pair used with TLS client
authentication (CTLS)
2. Replace TriggerNonce with AC in KeyProvTrigger, and assume
KeyProvTrigger is part of Web-based authentication (WBA) or AC is passed
through some other means inherent in the WBA, e.g., as part of a SOAP
message in a DSKPP WS (i.e., authenticate user using any Web mechanism,
then use AC as one-time secret value)
3. Use password portion of AC as passphrase in Passphrase-Based Key Wrap
Profile

We can reduce the combinations as follows -

4-pass:
WBA (includes AC)
AC (no WBA)

2-pass:
WBA (includes AC) + CTP
WBA (includes AC) + PBKW (AC is used as the passphrase)
WBA (includes AC) + KW
AC (no WBA) + CTP
AC (no WBA) + PBKW (AC is used as the passphrase)
AC (no WBA) + KW

<KeyProvTrigger> only needs to be discussed as part of the protocol
initiation (with WBA) process, except in schema and example.

Let me know your thoughts soon.
I'm editing the doc now.
Thanks,
Andrea

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov