Subject: [KEYPROV] [issue28] How to transfer initial PIN to a client via PSKC?

From: Mingliang Pei <[email-masked]>
Date: Fri, 21 Sep 2007 08:58:10 +0000

New submission from Mingliang Pei <[email-masked]>:

PSKC provies support about carrying PIN usage policy. When PIN is used, how do 
you actually transfer the initial PIN using PSKC? Should PIN be treated as 
another credential, for example?

----------
assignedto: mpei
messages: 71
nosy: keyprov, mpei
priority: critical
status: chatting
title: How to transfer initial PIN to a client via PSKC?

_________________________________________________________
KEYPROV Roundup Issue Tracker <[email-masked]>
<http://www.tschofenig.priv.at:8080/keyprov/issue28>
_________________________________________________________

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/keyprov

---

From: "Philip Hoyer" <[email-masked]>
Date: Fri, 28 Sep 2007 17:47:58 +0200

Gentlemen,
Since PSKC will be used also to bulk provision from manufacturing to a
validation server and some of these devices do have a PIN pad there is
the concept of an initial PIN.

Since we have not yet defined how this initial PIN is transmitted in the
PSKC spec I would like to put forward a proposal for inclusion in the
spec for specifying the transmission of PINs.

The PIN is effectively another shared secret hence I propose to treat it
as a key in itself.

This has the advantage that we can leverage the Usage part of the schema
that can define things like length and format (alphanumeric etc). we
also can set an expiry etc. It also leverages the fact that the PIN
itself will be encrypted in transport in the same manner as other key
material.

I hence propose to extend the KeyAlgorithmType with a new type called
'userPIN' (inline with the name used in the access rules element already
present)

As an example a KeyContainer with a non encrypted HOTP key and a 4 digit
numeric PIN (please note that the value and valuedigest are just copy
and paste) ( I put the new section with NEW-> and <-NEW lines before and
after):

   <?xml version="1.0" encoding="UTF-8"?>
   <KeyContainer
   xmlns="urn:ietf:params:xml:ns:keyprov:container"
   xmlns:logo="urn:ietf:params:xml:ns:keyprov:logo"
   xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="urn:ietf:params:xml:ns:keyprov:container"
.\keyprov_pskc_schema_v1.1.xsd" version="1.1">
     <EncryptionMethod algorithm="NONE"/>
     <DigestMethod algorithm="HMAC-SHA1"></DigestMethod>
     <Device>
       <DeviceId>
         <Manufacturer>Token Manufacturer</Manufacturer>
         <SerialNo>98765432187</SerialNo>
         <Expiry>01/01/2008</Expiry>
       </DeviceId>
       <Key KeyAlgorithm="HOTP"  KeyId="98765432187">
         <Issuer>Credential Issuer</Issuer>
         <Usage>
          <ResponseFormat format="DECIMAL" length="6"/>
         </Usage>
NEW->
         <AccessRules userPIN="true"/>
<-NEW
         <FriendlyName>MyFirstToken</FriendlyName>
         <Data Name="SECRET">
           <Value>WldjTHZwRm9YTkhBRytseDMrUnc=</Value>
           <ValueDigest>WldjTHZwRm9YTkhBRytseDM=</ValueDigest>
         </Data>
         <Data Name="COUNTER">
           <Value>WldjTHZwRm9YTkhBRytseDMrUnc=</Value>
           <ValueDigest>WldjTHZwRm9YTkhBRytseDM=</ValueDigest>
         </Data>
       </Key>
NEW->
       <Key KeyAlgorithm="userPIN"  KeyId="12345678">
         <Issuer>Credential Issuer</Issuer>
         <Usage>
          <ResponseFormat format="DECIMAL" length="4"/>
         </Usage>
         <FriendlyName>MyFirstTokenInitialPIN</FriendlyName>
         <Data Name="SECRET">
           <Value>WldjTHZwRm9YTkhBRytseDMrUnc=</Value>
           <ValueDigest>WldjTHZwRm9YTkhBRytseDM=</ValueDigest>
         </Data>
       </Key>
<-NEW
     </Device>
   </KeyContainer>

Comments are welcome,

Philip

-----Original Message-----
From: Mingliang Pei [mailto:[email-masked]] 
Sent: Friday, September 21, 2007 9:58 AM
To: [email-masked]
Subject: [KEYPROV] [issue28] How to transfer initial PIN to a client
viaPSKC?

PSKC provies support about carrying PIN usage policy. When PIN is used,
how do 
you actually transfer the initial PIN using PSKC? Should PIN be treated
as 
another credential, for example?

----------
assignedto: mpei
messages: 71
nosy: keyprov, mpei
priority: critical
status: chatting