Subject: [kitten] PKCROSS I-D updated: drop LoF/TOFU/pseudonymity business

From: Nico Williams <[email-masked]>
Date: Mon, 27 Oct 2014 02:14:21 -0500

I'm dropping the LoF/TOFU business for now.  It should go into a
separate I-D.  This simplifies the PKCROSS I-D a fair bit.

Update just submitted.

Nico
--

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 27 Oct 2014 16:33:07 -0400 (EDT)

> separate I-D.  This simplifies the PKCROSS I-D a fair bit.

"hierarchical trust hierarchies" is a bit redundant.

> [[anchor2: QUESTION: Should the PKINIT request in step #3 be required
> to be used within a FAST tunnel?]]

Er, what sort of FAST tunnel is possible?  Anonymous PKINIT from the same
certificate being used here?  That doesn't seem to add much value.

I don't have anything else that jumped out at me reading the diff from -02
to -04, but didn't do a full review.

-Ben

---

From: Nico Williams <[email-masked]>
Date: Mon, 27 Oct 2014 15:58:33 -0500

> certificate being used here?  That doesn't seem to add much value.

It's always possible to add one more anon PKINIT tunnel... :)

The point is to protect the client's identity (certificate).

> to -04, but didn't do a full review.

There's no urgency, of course.  But I would like to request that
KITTEN adopt this and, more importantly,
draft-williams-kitten-krb5-extra-rt.

Nico
--