Subject: Re: [kitten] WGLC on draft-ietf-kitten-pkinit-freshness-01

From: Michiko Short <[email-masked]>
Date: Mon, 17 Aug 2015 21:19:17 +0000

How about:

   1.  The client generates a KRB_AS_REQ as specified in Section 2.9.3
       [RFC4120] without an authenticator that requests a freshness
       token.

-----Original Message-----

Message: 3
Date: Sun, 16 Aug 2015 11:31:46 -0400 (EDT)
From: Benjamin Kaduk <[email-masked]>
To: [email-masked]
Subject: Re: [kitten] WGLC on draft-ietf-kitten-pkinit-freshness-01
Message-ID: <[email-masked]>
Content-Type: TEXT/PLAIN; charset=US-ASCII

On Sun, 16 Aug 2015, Benjamin Kaduk wrote:

> This message begins the Working Group Last Call (WGLC) of "Public Key 
> Cryptography for Initial Authentication in Kerberos (PKINIT) Freshness 
> Extension" <draft-ietf-kitten-pkinit-freshness-01>. The WGLC will last 
> two weeks, ending on Sunday, August 30th.  The draft is available at:
>
> https://tools.ietf.org/html/draft-ietf-kitten-pkinit-freshness-01

One minor thing occurred to me while I was reading through prior to starting the WGLC: in section 2, bullet 1, the current text has "without an authenticator which includes the freshness token request to the KDC", which doesn't seem quite right -- this un-preauthenticated AS-REQ does not have a freshness token included in it, but it is intended to request a freshness token from the KDC.  So, it might be better to just say "without an authenticator that includes a freshness token" [0].  (It would not be correct to say "with an authenticator that does not include a freshness token", right?)

-Ben

[0] The RFC Editor would change "which" to "that", since their criterion is that "which" is used when clarifying a property of all occurrences of the class being described, whereas "that" is used when the additional clause is actually adding qualifiers.

------------------------------

Subject: Digest Footer

_______________________________________________
Kitten mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/kitten

------------------------------

End of Kitten Digest, Vol 129, Issue 5
**************************************

---

From: Greg Hudson <[email-masked]>
Date: Mon, 17 Aug 2015 17:35:24 -0400

>        [RFC4120] without an authenticator that requests a freshness

Just to make sure: the intent of the text is that the initial KRB_AS_REQ
does not include PA_PK_AS_REQ pa-data, but does include PA_AS_FRESHNESS
pa-data requesting a freshness token.  The suggested clarification do
not convey this intent.  I suggested a different clarification in my
longer response.

---

From: Michiko Short <[email-masked]>
Date: Thu, 20 Aug 2015 18:42:41 +0000

I saw that. Appreciated your long, complete feedback. Have done a quick look and the only significant change I saw was the error. 

-----Original Message-----
From: Greg Hudson [mailto:[email-masked]] 
Sent: Monday, August 17, 2015 2:35 PM
To: Michiko Short <[email-masked]>; [email-masked]
Subject: Re: [kitten] WGLC on draft-ietf-kitten-pkinit-freshness-01

>        [RFC4120] without an authenticator that requests a freshness

Just to make sure: the intent of the text is that the initial KRB_AS_REQ does not include PA_PK_AS_REQ pa-data, but does include PA_AS_FRESHNESS pa-data requesting a freshness token.  The suggested clarification do not convey this intent.  I suggested a different clarification in my longer response.