Subject: [KEYPROV] Key package vs key container

From: <[email-masked]>
Date: Wed, 28 Jan 2009 20:47:09 -0500

The following comment was provided re our use of 'Key Package' in DSKPP:
          "Key Package", which is slightly confusing name for something
that doesn't include a key, at least in all protocol variants. PSKC
calls it "Key Container".)

The suggested change is for DSKPP to change 'Key Package' to 'Token
Attributes'.  Assuming we change 'Cryptographic Module' to
'Authentication Token', I think 'Token Attributes' is much clearer and
better aligned with PSKC.

I'll proceed accordingly unless I hear something to the contrary within
the next day or two.
Thanks,
Andrea
_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov

---

From: "Pei, Mingliang" <[email-masked]>
Date: Wed, 28 Jan 2009 18:38:48 -0800

We have been using "Key xxx" to describe the target that DSKPP and PSKC
provision. The specifications deal with key provisioning after all.
"Token Attributes" seems to be away from "key"; I don't feel that it is
better than "Key Package". I can live with "Key Container" in DSKPP -
the default is PSKC Key Container, and ASN.1 version is KeyPackage.

- Ming

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of [email-masked]
> Sent: Wednesday, January 28, 2009 5:47 PM
> To: [email-masked]
> Subject: [KEYPROV] Key package vs key container
> 
>           "Key Package", which is slightly confusing name for 
> something that doesn't include a key, at least in all 
> protocol variants. PSKC calls it "Key Container".)
> 
> The suggested change is for DSKPP to change 'Key Package' to 
> 'Token Attributes'.  Assuming we change 'Cryptographic 
> Module' to 'Authentication Token', I think 'Token Attributes' 
> is much clearer and better aligned with PSKC.
> 
> I'll proceed accordingly unless I hear something to the 
> contrary within the next day or two.
> Thanks,
> Andrea

---

From: [email-masked]
Date: Thu, 29 Jan 2009 08:51:58 -0500

The reason that we chose Key Package over Key Container is because PSKC
Key Container may include multiple keys whereas DSKPP only handles one.

Sean - did you use Key Package for the same reason?  I thought the ASN.1
could handle multiple keys?

Ming - what does PSKC refer to as the thing that holds a single key?
What about Token Key Attributes?

Andrea 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Pei, Mingliang
Sent: Wednesday, January 28, 2009 9:39 PM
To: Doherty, Andrea; [email-masked]
Subject: Re: [KEYPROV] Key package vs key container

- Ming

---

From: <[email-masked]>
Date: Thu, 29 Jan 2009 08:55:44 -0500

Ming,
FYI -
Instead of "Key": if we change from crypto module to Authentication
Token and Token Algorithm, we can also refer to Token Key (aka K_TOKEN),
and then Token Attributes (I agree, better to have Key in the label, so
perhaps 'Token Key Attributes').  Please refer to Sec 2.1.1 of the draft
I sent on Tuesday.
Andrea 

-----Original Message-----

- Ming

---

From: [email-masked]
Date: Thu, 29 Jan 2009 09:33:40 -0500

Sorry about all the emails on this one...

If the ASN.1 draft were to change 'Key Package' to 'Key Container', and
DSKPP did the same, it would make the docs better aligned.

The term 'Token Attributes' are still needed to describe the
"configuration data" passed in the container by <KeyProvServerFinished>.
This term was missing before.

Thoughts?
Andrea

-----Original Message-----

- Ming

---

From: Sean Turner <[email-masked]>
Date: Thu, 29 Jan 2009 12:07:40 -0500

Honestly, I'm not sure whether Key Package or Key Container is clearer 
about whether or not there is a key inside.  Can't people make the leap 
that one calls it a container and the other a package.  I mean 
initially, I thought this is an easy fix but then there's the fact that 
the OID is registered in the arc and it's been out for about a year.

spt

---

From: "Pei, Mingliang" <[email-masked]>
Date: Thu, 29 Jan 2009 10:26:36 -0800

> What about Token Key Attributes?

It is referred as simply <Key> element with <KeyType>. Attributes are
under <Key>/<Data>, for example, <Key>/<Data>/<Counter> etc.
 
BTW, the Cryptographic Module in current DSKPP isn't wrong. It precisely
reflects what the protocol tries to do in protocol language. Only
"Authentication Token" is easy to understand for most audience in
typical authentication world. For any potential leverage or extension in
generic key provisioning such as Kerberos or storage AES encryption key,
"Authentication Token" world will be limiting us. I assume that we may
develop an extension later to support other use cases because of the
current reduction on algorithm and authentication options.

- Ming 

> From: [email-masked] [mailto:[email-masked]] 
> Sent: Thursday, January 29, 2009 5:52 AM
> To: Pei, Mingliang; [email-masked]
> Subject: RE: [KEYPROV] Key package vs key container
> 
> The reason that we chose Key Package over Key Container is 
> because PSKC Key Container may include multiple keys whereas 
> DSKPP only handles one.
> 
> 
> Sean - did you use Key Package for the same reason?  I 
> thought the ASN.1 could handle multiple keys?
> 
> [mailto:[email-masked]] On Behalf Of Pei, Mingliang
> We have been using "Key xxx" to describe the target that 
> DSKPP and PSKC provision. The specifications deal with key 
> provisioning after all.
> "Token Attributes" seems to be away from "key"; I don't feel 
> that it is better than "Key Package". I can live with "Key 
> Container" in DSKPP - the default is PSKC Key Container, and 
> ASN.1 version is KeyPackage.
> 
> - Ming
> 
> > something that doesn't include a key, at least in all protocol 
> > variants. PSKC calls it "Key Container".)
> > 
> > 'Authentication Token', I think 'Token Attributes'
> > I'll proceed accordingly unless I hear something to the contrary 
> > within the next day or two.
> > Thanks,
> > Andrea

---

From: <[email-masked]>
Date: Thu, 29 Jan 2009 14:06:50 -0500

Philip Hoyer had similar remarks.

I'll keep it to crypto module with authN token as an example.

Let's continue to use Key Package rather than Key Container.

Thanks for your inputs.

Andrea 

-----Original Message-----
From: Pei, Mingliang [mailto:[email-masked]] 
Sent: Thursday, January 29, 2009 1:27 PM
To: Doherty, Andrea; [email-masked]
Subject: RE: [KEYPROV] Key package vs key container

 

- Ming