Subject: [KEYPROV] Another DSKPP simplification option

From: [email-masked]
Date: Sun, 25 Jan 2009 19:32:39 -0500

Pasi and Ming both made a suggestion regarding the Authentication Code
that I'd like to explore --- would appreciate any discussion:
Authentication Code and passphrase used in PBKW (one of the two-pass key
protection profiles) are both one-time values that are delivered
out-of-band.  Perhaps the passphrase used for PBKW could be the
Authentication Code.  In other words, as Ming suggested, "When an AC is
given, the password portion of AC could be used as the passphrase in
general...When a passphrase based key wrap profile is used, the AC code
will be the passphrase."

While I am considering removing the TriggerMessage altogether, I
realized that this would eliminate (among other things) implementor's
ability to support Web-based authentication, as an alternative to
protocol-based authentication.  Pasi suggested, "Perhaps the
KeyProvTrigger message could deliver an Authentication Code (instead of
TriggerNonce) and from there on, the protocol would continue the same as
with manually entered authentication code?"

So, what I am planning to do then, as a first step, is to have the AC
used in KeyProvTrigger or KeyProvClientHello, and in either case, the
password portion of it would be used for the passphrase-based key wrap
profiile rather than requiring implementors to have user provide yet
another passphrase/string out-of-band.

Thoughts?
Andrea
 
_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov