Subject: [KEYPROV] Comments on DSKPP draft section 1.

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 31 Oct 2008 13:48:17 -0700

I have reworded sectiI am editing the DSKPP draft to try to address Passi's comment on the readability.
 
One change in particular that I think might be necessary is to change 'Key Renewal' to 'Key Rollover'.
 
The problem I have with 'renewal' is that it implies that something is kept the same but somehow made new. What the spec is describing is replacing of one cryptographic key with a totally different one. That is not renewal. If I say that I have 'renewed' my car, people are going to think that I have replaced the worn parts and given the rest a polishing, not that I went to the dealer and traded it in for a new one.
 
I think that the term 'rollover' is more consistent with accepted usage and conveys the concept better. Do folk agree?

I also think that the intro is losing folk, so I have reworded it as follows:

1.  Introduction

   While the range of problems for which symmetric key cryptography is
   the solution of choice is somewhat smaller than for public key
   cryptography, the problems it does solve, it solves exceedingly well.
   In particular, symmetric key algorithms are considerably faster than
   public key equivalents and allow for smaller key and signature sizes.

   Despite the clear advantages of employing symmetric keys as long term
   credentials or access keys in certain circumstances, it has generally
   been assumed that any protocol in which ease of key management is
   required will employ public key cryptography.  In particular it is
   assumed that only private components of public keypairs will be
   employed as long term secrets and that symmetric cryptography will
   only play a supporting role.

   This document describes the Dynamic Symmetric Key Provisioning
   Protocol (DSKPP), which provides a mechanism for provisioning
   symmetric keys that provides the same degree of flexibility and
   convenience in use as equivalent infrastructures for public keys.

   DSKPP enables provisioning of symmetric keys to a symmetric key
   cryptographic module that provides data authentication and encryption
   services to software (or firmware) applications hosted on a wide
   range of hardware devices, such as personal computers, handheld
   mobile phones, one-time password tokens, USB flash drives, tape
   drives, etc.

   DSKPP provides an open and interoperable mechanism for initializing
   and configuring symmetric keys to cryptographic modules that are
   accessible over the Internet.  The description is based on the
   information contained in RFC4758, and contains specific enhancements,
   such as User Authentication and support for the [PSKC] format for
   transmission of keying material.

Comments?
_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov

---

From: "Pei, Mingliang" <[email-masked]>
Date: Fri, 31 Oct 2008 16:23:16 -0700

The changes look good to me.
 
- Ming

________________________________

	From: [email-masked] [mailto:[email-masked]]
On Behalf Of Hallam-Baker, Phillip
	Sent: Friday, October 31, 2008 1:48 PM
	To: [email-masked]
	Subject: [KEYPROV] Comments on DSKPP draft section 1.

	I have reworded sectiI am editing the DSKPP draft to try to
address Passi's comment on the readability.
	 
	One change in particular that I think might be necessary is to
change 'Key Renewal' to 'Key Rollover'.
	 
	The problem I have with 'renewal' is that it implies that
something is kept the same but somehow made new. What the spec is
describing is replacing of one cryptographic key with a totally
different one. That is not renewal. If I say that I have 'renewed' my
car, people are going to think that I have replaced the worn parts and
given the rest a polishing, not that I went to the dealer and traded it
in for a new one.
	 
	I think that the term 'rollover' is more consistent with
accepted usage and conveys the concept better. Do folk agree?

	I also think that the intro is losing folk, so I have reworded
it as follows:

	1.  Introduction
	
	   While the range of problems for which symmetric key
cryptography is
	   the solution of choice is somewhat smaller than for public
key
	   cryptography, the problems it does solve, it solves
exceedingly well.
	   In particular, symmetric key algorithms are considerably
faster than
	   public key equivalents and allow for smaller key and
signature sizes.
	
	   Despite the clear advantages of employing symmetric keys as
long term
	   credentials or access keys in certain circumstances, it has
generally
	   been assumed that any protocol in which ease of key
management is
	   required will employ public key cryptography.  In particular
it is
	   assumed that only private components of public keypairs will
be
	   employed as long term secrets and that symmetric cryptography
will
	   only play a supporting role.
	
	   This document describes the Dynamic Symmetric Key
Provisioning
	   Protocol (DSKPP), which provides a mechanism for provisioning
	   symmetric keys that provides the same degree of flexibility
and
	   convenience in use as equivalent infrastructures for public
keys.
	
	   DSKPP enables provisioning of symmetric keys to a symmetric
key
	   cryptographic module that provides data authentication and
encryption
	   services to software (or firmware) applications hosted on a
wide
	   range of hardware devices, such as personal computers,
handheld
	   mobile phones, one-time password tokens, USB flash drives,
tape
	   drives, etc.
	
	   DSKPP provides an open and interoperable mechanism for
initializing
	   and configuring symmetric keys to cryptographic modules that
are
	   accessible over the Internet.  The description is based on
the
	   information contained in RFC4758, and contains specific
enhancements,
	   such as User Authentication and support for the [PSKC] format
for
	   transmission of keying material.

	Comments?