Subject: [KEYPROV] DSKPP question re term

From: <[email-masked]>
Date: Wed, 28 Jan 2009 20:23:52 -0500

In reviewing Pasi's terminology changes for better aligning DSKPP and
PSKC, while keeping the scope limited to the original charter of
supporting authentication tokens, I've come to the conclusion that his
use of the protocol client terms, e.g., authentication token and token
algorithm are much clearer than the use of the broader and less concrete
term "cryptographic module":
     Authentication Token: A device or software component that uses 
     symmetric key(s) to support authentication (for example,
     one-time passwords or challenge-response) using one or more  
     Token Algorithms.

     Token Algorithm: Determines the allowed lengths of the Token Key,
     the cryptographic operations that can be performed (e.g. OTP
     computation or challenge-response) and their inputs, outputs, and
     algorithms; and what Token Attributes can be used. (TODO: This is
     called "Key Type" in PSKC, but I think we need a better term.)
     Some examples of Token Algorithms are HOTP [RFC4226], S/Key
     [RFC1760], and SecurID-AES. In DSKPP, Token Algorithms are
     identified by URIs.

     ...

To ensure consistency throughout the doc, then, I would like to replace
"cryptographic module" with "authentication token" throughout.  For
example, doing this replacement changes the 1st paragraph of the
Abstract to say:
	   DSKPP is a client-server protocol for initialization (and
	   configuration) of symmetric keys to locally and remotely
accessible
	   authentication tokens.  The protocol can be run with or
without
	   private-key capabilities in the authentication tokens, and
with or
	   without an established public-key infrastructure.

I recognize this a change over what we agreed to early on, but IMO it
has the effect of making the scope and application of the document more
immediately comprehensible.

If anyone disagrees or otherwise has comments, please respond within the
couple of days.  We are working hard to get an update out asap.

Thanks,
Andrea
_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov

---

From: "Pei, Mingliang" <[email-masked]>
Date: Wed, 28 Jan 2009 18:52:18 -0800

The change is good for me. I think that it is more comprehensible. -
Ming

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of [email-masked]
> Sent: Wednesday, January 28, 2009 5:24 PM
> To: [email-masked]
> Subject: [KEYPROV] DSKPP question re term
> 
> In reviewing Pasi's terminology changes for better aligning 
> DSKPP and PSKC, while keeping the scope limited to the 
> original charter of supporting authentication tokens, I've 
> come to the conclusion that his use of the protocol client 
> terms, e.g., authentication token and token algorithm are 
> much clearer than the use of the broader and less concrete 
> To ensure consistency throughout the doc, then, I would like 
> to replace "cryptographic module" with "authentication token" 
> throughout.  For example, doing this replacement changes the 
> 1st paragraph of the Abstract to say:
> 	   configuration) of symmetric keys to locally and 
> remotely accessible
> 	   authentication tokens.  The protocol can be run with 
> or without
> 	   private-key capabilities in the authentication 
> tokens, and with or
> I recognize this a change over what we agreed to early on, 
> but IMO it has the effect of making the scope and application 
> of the document more immediately comprehensible.
> 
> If anyone disagrees or otherwise has comments, please respond 
> within the couple of days.  We are working hard to get an 
> update out asap.
> 
> Thanks,
> Andrea

---

From: <[email-masked]>
Date: Thu, 29 Jan 2009 08:53:43 -0500

Thanks Ming.

Do others agree?

---

From: Sean Turner <[email-masked]>
Date: Thu, 29 Jan 2009 12:07:20 -0500

Are we unnecessarily narrowing the scope too much?  I honestly prefer 
the more general language of module as opposed to token.

spt