Subject: [kitten] Toward Depreciating Encrypted Timestamp

From: "Henry B (Hank) Hotz, CISSP" <[email-masked]>
Date: Tue, 3 Oct 2017 11:14:42 -0700

With SPAKE, on top of the earlier FAST and PKINIT work, we clearly are headed toward obsoleting encrypted timestamp. Should we be considering what other steps to take supporting this path?

I’m just asking. Personally, I think we need some serious field experience with SPAKE before we do anything else. It will take a ridiculous number of years before we can assume the majority of clients support SPAKE.

Personal email.  [email-masked]

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 3 Oct 2017 21:03:16 -0500

> With SPAKE, on top of the earlier FAST and PKINIT work, we clearly are headed toward obsoleting encrypted timestamp. Should we be considering what other steps to take supporting this path?

We should probably be considering it, yes.

> I’m just asking. Personally, I think we need some serious field experience with SPAKE before we do anything else. It will take a ridiculous number of years before we can assume the majority of clie…

But I agree that we probably will need more field experience before we can
say a whole lot -- we have some experience with FAST and that it's not
a whole lot of fun to deploy in large environments.  Maybe SPAKE will be
better; maybe not.

-Ben

---

From: Simo Sorce <[email-masked]>
Date: Wed, 04 Oct 2017 08:05:25 -0400

On Tue, 2017-10-03 at 21:03 -0500, Benjamin Kaduk wrote:
> > With SPAKE, on top of the earlier FAST and PKINIT work, we clearly
> > are headed toward obsoleting encrypted timestamp. Should we be
> > considering what other steps to take supporting this path?
> 

Agree, but we'll need a few years of solid SPAKE use first IMHO.

> > I’m just asking. Personally, I think we need some serious field
> > experience with SPAKE before we do anything else. It will take a
> > ridiculous number of years before we can assume the majority of
> > clients support SPAKE.
> 
> But I agree that we probably will need more field experience before
> we can say a whole lot -- we have some experience with FAST and that
> it's not a whole lot of fun to deploy in large environments.  Maybe
> SPAKE will be better; maybe not.

Well I sure hope it will be better as the reason we came up with it was
 strongly influenced by the pain of using/deploying FAST and we wanted
something that would be more seamless.

Simo.

-- 
Simo Sorce
Sr. Principal Software Engineer
Red Hat, Inc