Subject: [KEYPROV] Updated PSKC draft

From: "Pei, Mingliang" <[email-masked]>
Date: Tue, 7 Oct 2008 20:43:37 -0700

Attached please find the latest revision updated today. The changes in
this revision include the following:
 
Main changes:
 
- IANA section: 
 
1. Added additional constraints that incorporates Pasi's suggestions and
Hannes's text for HOTP as sample.
2. Also changed for OCRA, TOTP, and SecurID-AES and SecurID-AES-Counter
sections.
 
Minor changes:
 
1. Changed "This work is a joint effort by the members of OATH..." to
"This work is based on earlier work by the members of OATH...".
 
2. "This Internet draft describes" to ""This document describes"
 
3. PKCS#12 comparison section: remove argument about small size. Focus
on explicit attribute and web service.
 
4. Change "Encryption Key" to "Key Encryption Key"
 
5. Replace "cryptomodule" with "Cryptographic Module"
 
6. Section 3.1.3/3.1.4, expand acronyms "SD" and "OTA"
 
7. Section 5.1: "keyed digest" -> "Message Authentication Code (MAC)"
 
8. Section 5.1: "signature" -> "signature or Message Authentication
Code" (MAC)", 
 
9. Section 5.1, typo "defintion"
 
10. Section 5.1, the example about "Extensions" are fixed
 
11. Section 5.4: KeyAlgorithm is made to be mandatory.
 
12. Section 6.1.1: Only kw-aes128 is now set as mandatory. All the
others are set as optional. Also changed to list Camellia ones in the
optional list.
 
The list above doesn't have all the changes pointed out by Pasi. I will
include the remaining changes in the next update.

- Ming

________________________________

	From: Philip Hoyer [mailto:[email-masked]] 
	Sent: Tuesday, October 07, 2008 8:52 AM
	To: [email-masked]; [email-masked];
Hallam-Baker, Phillip; [email-masked]; Pei, Mingliang
	Subject: Keyprov call minutes 7/10/08

	Attendees: Andrea, Hannes, Phillip Hallam Baker, Ming, Salah

	Andrea to review RSA algorithm definition

	Philip Hoyer to add/review ActivIdentity algorithms

	Ming to send latest revision a revision today 

	We are planning to have one revision to be submitted to IETF
before November 3rd.

	Philip Hoyer asked about SKSML and it was defined that the
charter is different but Philip Hoyer to do an analysis in terms of key
container and to send Arshad Noor's paper and presentation to the
authors.

	Ming mentioned that there are some comments from Pasi that
require schema change. Agreement that they should be sent around in a
separate email thread for discussion

	Quick discussion about IETF. Hannes stressed that it is
important that authors will be there or at least let everyone know in
terms of attendance. But not repeat what happened in Dublin. Andrea will
come.

	________________________________

	Philip Hoyer 

	Senior Architect - Office of CTO

	ActivIdentity (UK)

	117 Waterloo Road

	London SE1 8UL

	Telephone: +44 (0) 20 7960 0220

	Fax: +44 (0) 20 7902 1985

	Private and confidential: This message and any attachments may
contain

	privileged / confidential information. If you are not an
intended recipient,

	you must not copy, distribute, discuss or take any action in
reliance on it.

	If you have received this communication in error, please notify
the sender

	and delete this message immediately.

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov

---

From: "Pei, Mingliang" <[email-masked]>
Date: Thu, 16 Oct 2008 14:43:45 -0700

I added two more schema adjustment in this version as follows.
 
1. Use xml:id in place of ID of type xs:ID per Pasi's suggestion. I
agree with him that it is a better practice.
2. xmlenc schema location points to a dated version instead of the
general last version. The reason for this is that the same schema should
be used if some dependent namespace such as PKCS#5 XML also imports the
xmlenc namespace and its schema file location.
 
<xs:import namespace="http://www.w3.org/2001/04/xmlenc#"
schemaLocation="http://www.w3.org/TR/xmlenc-core/xenc-schema.xsd"/>
 
to
 
<xs:import namespace="http://www.w3.org/2001/04/xmlenc#"
schemaLocation="
http://www.w3.org/TR/2002/REC-xmlenc-core-20021210/xenc-schema.xsd"/>
 
Please review.
 
- Ming

	From: Pei, Mingliang 
	Sent: Tuesday, October 07, 2008 8:44 PM
	To: Philip Hoyer; [email-masked];
[email-masked]; Hallam-Baker, Phillip;
[email-masked]
	Cc: [email-masked]
	Subject: Updated PSKC draft

	Attached please find the latest revision updated today. The
changes in this revision include the following:

	Main changes:
	 
	- IANA section: 
	 
	1. Added additional constraints that incorporates Pasi's
suggestions and Hannes's text for HOTP as sample.
	2. Also changed for OCRA, TOTP, and SecurID-AES and
SecurID-AES-Counter sections.
	 
	Minor changes:
	 
	1. Changed "This work is a joint effort by the members of
OATH..." to "This work is based on earlier work by the members of
OATH...".

	3. PKCS#12 comparison section: remove argument about small size.
Focus on explicit attribute and web service.

	 
	 
	7. Section 5.1: "keyed digest" -> "Message Authentication Code
(MAC)"
	 
	8. Section 5.1: "signature" -> "signature or Message
Authentication Code" (MAC)", 

	 
	 
	12. Section 6.1.1: Only kw-aes128 is now set as mandatory. All
the others are set as optional. Also changed to list Camellia ones in
the optional list.
	 
	The list above doesn't have all the changes pointed out by Pasi.
I will include the remaining changes in the next update.
	
	- Ming

		From: Philip Hoyer
[mailto:[email-masked]] 

		Attendees: Andrea, Hannes, Phillip Hallam Baker, Ming,
Salah

		We are planning to have one revision to be submitted to
IETF before November 3rd.

		Philip Hoyer asked about SKSML and it was defined that
the charter is different but Philip Hoyer to do an analysis in terms of
key container and to send Arshad Noor's paper and presentation to the
authors.

		Ming mentioned that there are some comments from Pasi
that require schema change. Agreement that they should be sent around in
a separate email thread for discussion

		 

		Philip Hoyer 

		ActivIdentity (UK)

		117 Waterloo Road

		London SE1 8UL

		Private and confidential: This message and any
attachments may contain

		you must not copy, distribute, discuss or take any
action in reliance on it.

		If you have received this communication in error, please
notify the sender

---

From: "Pei, Mingliang" <[email-masked]>
Date: Thu, 16 Oct 2008 18:57:23 -0700

I have captured the current open issues and working items that Pasi and
others raised into the attached document. We can discuss the list in the
next week's conference call, and work to resolve them. My assessment is
that some items can be quickly resolved and a few needs particular
discussion. Please review and update it if I missed something.
 
Thanks,
 
- Ming

	From: Pei, Mingliang 

	Main changes:
	 
	- IANA section: 

	Minor changes:

	 

	 

	 

	 

	- Ming

		From: Philip Hoyer

		 

		Philip Hoyer 

		ActivIdentity (UK)

		117 Waterloo Road

		London SE1 8UL

---

From: "Philip Hoyer" <[email-masked]>
Date: Mon, 20 Oct 2008 17:08:27 +0200

Ming,

I believe we discussed previously that
http://www.w3.org/2001/04/xmlenc#aes256-cbc for key protection should be
mandatory for interoperability. This is the most used algorithm in
current PSKC implementations that I have visibility of.

Philip

From: Pei, Mingliang [mailto:[email-masked]] 
Sent: Wednesday, October 08, 2008 4:44 AM
To: Philip Hoyer; [email-masked]; [email-masked];
Hallam-Baker, Phillip; [email-masked]
Cc: [email-masked]
Subject: Updated PSKC draft

Main changes:

- IANA section: 

Minor changes:

- Ming

	 

	Philip Hoyer 

	ActivIdentity (UK)

	117 Waterloo Road

	London SE1 8UL

---

From: "Philip Hoyer" <[email-masked]>
Date: Mon, 20 Oct 2008 19:23:23 +0200

Ladies and Gentlemen,

Please find attached a new work in progress draft where I added the
ActivIdentity algorithm descriptions.

Philip

From: Pei, Mingliang [mailto:[email-masked]] 
Sent: Thursday, October 16, 2008 10:44 PM
To: Pei, Mingliang; Philip Hoyer; [email-masked];
[email-masked]; Hallam-Baker, Phillip;
[email-masked]
Cc: [email-masked]
Subject: RE: Updated PSKC draft

<xs:import namespace="http://www.w3.org/2001/04/xmlenc#"
schemaLocation="http://www.w3.org/TR/xmlenc-core/xenc-schema.xsd"/
<http://www.w3.org/TR/xmlenc-core/xenc-schema.xsd> >

to

<xs:import namespace="http://www.w3.org/2001/04/xmlenc#"
schemaLocation="
http://www.w3.org/TR/2002/REC-xmlenc-core-20021210/xenc-schema.xsd"/
<http://www.w3.org/TR/2002/REC-xmlenc-core-20021210/xenc-schema.xsd> >

Please review.

- Ming

	From: Pei, Mingliang 

	Main changes:

	- IANA section: 

	Minor changes:

	- Ming

		From: Philip Hoyer

		 

		Philip Hoyer 

		ActivIdentity (UK)

		117 Waterloo Road

		London SE1 8UL

---

From: "Pei, Mingliang" <[email-masked]>
Date: Mon, 20 Oct 2008 12:04:22 -0700

Hi Philip,
 
Thanks for noticing it. I thought that it was kw-x version and the key
length is 128. I just did some more check, it seems that we should
choose aes128-cbc. DSKPP makes aes128-cbc as the mandatory one, which I
believe to be the same during the interim IETF meeting this Feb. We had
multiple mandatory ones in the early draft. When picking the single
mandatory one, I considered that kw-aes128-cbc is the best fit for key
wrapping. I just read that yrou have had comments on this that kw-x
wasn't available in some HSM. So the mandatory key wrap one should go to
 
http://www.w3.org/2001/04/xmlenc#aes128-cbc
<http://www.w3.org/2001/04/xmlenc#aes128-cbc> 
 
IETF 71-th minutes at
http://tools.ietf.org/wg/keyprov/minutes?item=minutes71.html
DSKPP mandatory value:
http://tools.ietf.org/html/draft-ietf-keyprov-dskpp-05
 
"f.  MUST support the following Encryption algorithms for symmetric
       key operations, e.g., key wrap:
       *  AES-CBC-128 [FIPS197-AES
<http://tools.ietf.org/html/draft-ietf-keyprov-dskpp-05#ref-FIPS197-AES>
]"

Comments?
 
- Ming

	From: Philip Hoyer [mailto:[email-masked]] 
	Sent: Monday, October 20, 2008 8:08 AM
	To: Pei, Mingliang; [email-masked];
[email-masked]; Hallam-Baker, Phillip;
[email-masked]
	Cc: [email-masked]
	Subject: RE: Updated PSKC draft

	Ming,

	Philip

	

	Main changes:

	- IANA section: 

	Minor changes:

	- Ming

		From: Philip Hoyer

		 

		Philip Hoyer 

		ActivIdentity (UK)

		117 Waterloo Road

		London SE1 8UL