Subject: [KEYPROV] I-D Action:draft-ietf-keyprov-dskpp-02.txt

From: [email-masked]
Date: Fri, 25 Jan 2008 15:30:01 -0500

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Provisioning of Symmetric Keys Working Group of the IETF.

	Title           : Dynamic Symmetric Key Provisioning Protocol (DSKPP)
	Author(s)       : A. Doherty, et al.
	Filename        : draft-ietf-keyprov-dskpp-02.txt
	Pages           : 96
	Date            : 2008-01-25

DSKPP is a client-server protocol for initialization (and
configuration) of symmetric keys to locally and remotely accessible
cryptographic modules.  The protocol can be run with or without
private-key capabilities in the cryptographic modules, and with or
without an established public-key infrastructure.

Two variations of the protocol support multiple usage scenarios.  The
four-pass (i.e., two round-trip) variant enables key generation in
near real-time.  With the four-pass variant, keys are mutually
generated by the provisioning server and cryptographic module;
provisioned keys are not transferred over-the-wire or over-the-air.
The two-pass variant enables secure and efficient download and
installation of symmetric keys to a cryptographic module in
environments where near real-time communication may not be possible.

This document builds on information contained in [RFC4758], adding
specific enhancements in response to implementation experience and
liaison requests.  It is intended that this document or a successor
version thereto will become the basis for subsequent progression of a
symmetric key provisioning protocol specification on the standards
track.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-keyprov-dskpp-02.txt

To remove yourself from the I-D Announcement list, send a message to
[email-masked] with the word unsubscribe in the body of 
the message.
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the 
username "anonymous" and a password of your e-mail address. After 
logging in, type "cd internet-drafts" and then
	"get draft-ietf-keyprov-dskpp-02.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-keyprov-dskpp-02.txt".

NOTE:   The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
KEYPROV mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/keyprov

---

From: "Doherty, Andrea" <[email-masked]>
Date: Fri, 25 Jan 2008 16:31:04 -0500

As announced below, I submitted an update to the DSKPP draft.  Comments
received in advance of the interim face-to-face meeting (Feb 6/7) would
be appreciated.  Here is the list of changes that were made in this
update:

1. Reworked the Introduction
	a. Cleaned up writing
	b. Simplified things
            c. Usage scenarios (provided better rationale for why one
might not want to depend on having a secure transport layer)
	d. Protocol variants (provided a list of circumstances in which
one would want to use four-pass DSKPP vs. two-pass DSKPP.  
               The previous version of the document was unclear in its
rationale for these variants, esp. four-pass.)
	e. Made small modification to the object model to make it
consistent with terminology used in the message flows
2. Removed all references to the one-pass protocol
3. Terminology
	a. Restructured/cleaned up organization
	b. Cleaned up notation
	c. Removed notation, etc. not in use within the document
4. Message flows
	a. Made them more readable
	b. Restructured to appear more like IKEV2 (RFC 4306)
5. "Client" Authentication
	a. Rewrote this section, which is now called "User
Authentication"
	b. Device authentication is a note, rather than called out
explicitly
	c. AuthenticationData only contains a MAC element now; it no
longer shows support for plaintext authcode, nor signature
	d. Cleaned up MAC calculation to rely on PBKDF2
6. Restructured document
	a. Moved Examples to the Appendix, and moved schema snippets
back into document.  This allowed me to consolidate three sections,
making the document more readable.
	b. Moved Key "Initialization" Profiles to the Two-Pass Protocol
Usage section
7. Schema changes
	a. Renamed "Key Initialization Profiles" to "Key Protection
Profiles" to avoid term-confusion with, e.g., DSKPP initialization (via
a trigger message)
	b. Removed TwoPassSupportType.  Now when ProtocolVariants is set
to "TwoPass", that element refers to KeyProtectionDataType
	c. KeyProtectionDataType type (formerly
KeyInitializationDataType) is no longer an extension
	d. Added KeyProtectionMethod to KeyContainerData Type so as to
make it more explicit which method is used for two-pass DSKPP
	d. Simplified AuthenticationDataType as noted in #5 above
	e. Fixed wording of annotations
	f. Updated Examples to reflect schema changes
8. Conformance Requirements
	a. Added a section that provides "MUST" support requirements for
the DSKPP server and client

Andrea 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, January 25, 2008 3:30 PM
To: [email-masked]
Cc: [email-masked]
Subject: [KEYPROV] I-D Action:draft-ietf-keyprov-dskpp-02.txt 

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Provisioning of Symmetric Keys Working
Group of the IETF.

	Title           : Dynamic Symmetric Key Provisioning Protocol
(DSKPP)
	Author(s)       : A. Doherty, et al.
	Filename        : draft-ietf-keyprov-dskpp-02.txt
	Pages           : 96
	Date            : 2008-01-25

Send a message to:
	[email-masked].
In the body type:

	a MIME-compliant mail reader.  Different MIME-compliant mail
readers

---

From: "Doherty, Andrea" <[email-masked]>
Date: Fri, 25 Jan 2008 16:42:54 -0500

The previous message was not very readable, so I've attached the list of
changes as a .txt file.
Andrea

-----Original Message-----
From: Doherty, Andrea 
Sent: Friday, January 25, 2008 4:31 PM
To: [email-masked]
Subject: FW: [KEYPROV] I-D Action:draft-ietf-keyprov-dskpp-02.txt 

Andrea 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, January 25, 2008 3:30 PM
To: [email-masked]
Cc: [email-masked]
Subject: [KEYPROV] I-D Action:draft-ietf-keyprov-dskpp-02.txt 

Send a message to:
	[email-masked].
In the body type: