Subject: [KEYPROV] IMPORTANT DISCUSSION: KeyId within PSKC

From: "Philip Hoyer" <[email-masked]>
Date: Mon, 14 Jun 2010 17:00:52 +0200

Ladies and Gentlemen,

One of the major discussion items that came up in the review of PSKC is
the KeyId.

Currently we have defined it as:

   'Id':  This attribute carries a globally unique identifier for the

      symmetric key.  The identifier is defined as a string of

      alphanumeric characters.

The main discussion point from Peter Saint-Andre:

"2. No guidance is provided about how to ensure that the 'Id' attribute
is
globally unique. To help ensure interoperability, a reference to RFC
4122 might
be in order.

"

Now what scope should we have for uniqueness here, do we really want the
KeyId to be globally unique?

If we do should we then use RFC 4122 or should we have a Issuer prefix
such as the PEN (http://www.iana.org/assignments/enterprise-numbers

E.g. "2396.12345 "  (2396 is the PEN for ActivCard/ActivIdentity

And ask the Key Issuing Enterprise to make sure it is unique under their
PEN prefix

Another question related to this was the fact that if we DO make keyed
unique then we will currently NOT allow a key to be used for more than
one algorithm.

For example one could foresee the same HOTP key to be used for OCRA.

Is this an issue?

Please let me know your thoughts so we can close this last big
outstanding issue.

Philip

________________________________

Philip Hoyer 

Senior Architect - Office of CTO

ActivIdentity (UK)

117 Waterloo Road

London SE1 8UL

Telephone: +44 (0) 20 7960 0220

Fax: +44 (0) 20 7902 1985

Private and confidential: This message and any attachments may contain

privileged / confidential information. If you are not an intended
recipient,

you must not copy, distribute, discuss or take any action in reliance on
it.

If you have received this communication in error, please notify the
sender

and delete this message immediately.

---

From: Sean Turner <[email-masked]>
Date: Mon, 14 Jun 2010 11:38:12 -0400

Philip Hoyer wrote:
> “2. No guidance is provided about how to ensure that the 'Id' attribute is
> 
> globally unique. To help ensure interoperability, a reference to RFC 4122 might
> 
> be in order.
> 
> “
> 
>  
> 

The examples don't show that it's unique.  Curious what you guys where 
thinking when you put the I-D together? ;)

> E.g. “2396.12345 “  (2396 is the PEN for ActivCard/ActivIdentity
> 
>  
> 

Can we do what PKIX did with it's key identifiers: use the output of a 
hash that's over some part of the structure that's always there (not 
the key in this case).  The problem with this approach is that there's 
not a lot that's mandatory to be there.

> privileged / confidential information. If you are not an intended recipient,
> 
> you must not copy, distribute, discuss or take any action in reliance on it.
> 
> If you have received this communication in error, please notify the sender
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> KEYPROV mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/keyprov

---

From: Sean Turner <[email-masked]>
Date: Thu, 17 Jun 2010 09:06:47 -0400

Do folks not think this is a big deal?  I would personally rather 
avoid registries if we can help it.

spt

Sean Turner wrote:
> Philip Hoyer wrote:
>> Ladies and Gentlemen,
>>
>> One of the major discussion items that came up in the review of PSKC 
>> is the KeyId.
>>
>>  
>>
>> Now what scope should we have for uniqueness here, do we really want 
>> the KeyId to be globally unique?
> 
>> And ask the Key Issuing Enterprise to make sure it is unique under 
>> their PEN prefix
>>
>>  
>>
> hash that's over some part of the structure that's always there (not the 
> key in this case).  The problem with this approach is that there's not a 
> lot that's mandatory to be there.
> 
>> Philip
>>
>>  
>>

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 17 Jun 2010 20:08:46 -0600

> thinking when you put the I-D together? ;)

To be clear, I'm not insisting that KeyID needs to be globally unique.
However, if we say it's globally unique then we need to provide some
guidance about how to construct it (one option is for it to be a UUID
per RFC 4122, but there are other options).

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: "Philip Hoyer" <[email-masked]>
Date: Thu, 24 Jun 2010 16:41:13 +0200

All,
Can we see a reason why the KeyIDs should be Globally unique?
 
I believe we could argue for 3 different levels of uniqueness:

1) Unique only in the scope of a single interaction between sender and
receiver
NOTE currently IF we wanted to provision the same key to multiple
devices or crypto elements we would have to use multiple KeyPackages
containing the same Key and hence the KeyId would NOT be unique even
within the container so Uniqueness would relate to attaching to the same
values. "If all Data elements of a Key are the same the KeyID MUST be
the same"

2) Unique between sender and receiver, this means that if PSKC would be
used to update key meta data values from one system to the other the
KeyId MUST be the same (multiple interactions between sender and
receiver using different containers referencing the same keys).

3) Globally unique - using UUID for example (but we would have to
specify the algorithm for UUID generation.

I believe that 2 represents a good compromise.

The receiving party of the PSKC package will be able to store keys
somehow uniquely (prefix with sender, generate an internal unique ID
etc)

Thoughts?

Philip

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Saint-Andre
Sent: Friday, June 18, 2010 3:09 AM
To: [email-masked]
Subject: Re: [KEYPROV] IMPORTANT DISCUSSION: KeyId within PSKC

On 6/14/10 9:38 AM, Sean Turner wrote:
>> "2. No guidance is provided about how to ensure that the 'Id'
>> attribute is

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Sean Turner <[email-masked]>
Date: Thu, 24 Jun 2010 14:51:46 -0400

> somehow uniquely (prefix with sender, generate an internal unique ID

I like 2.

spt

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 24 Jun 2010 20:53:45 +0200

I believe 2 should suffice for typical token usages.

I do though recall that I years ago suggested a scheme using a two-dimensional
GUID identifier consisting of Namespace URI + Local ID.  That's how most things
are identified although the Namespace URI often is implicit.

Nowadays, I've switched to Certified GUIDs in the form of x.509 certificates,
since they also support privacy-enabled key discovery + attribute filtering,
without relying on local secret/private keys or trust anchors.

Anders

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 24 Jun 2010 13:44:36 -0600

>> somehow uniquely (prefix with sender, generate an internal unique ID

That seems reasonable -- I never thought you guys wanted or needed or
globally unique KeyIDs, which is why I asked the question. :)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/