Subject: [kitten] draft-ietf-kitten-pkinit-freshness-01.txt

From: Michiko Short <[email-masked]>
Date: Fri, 19 Jun 2015 19:57:45 +0000

I believe we have answered Ben's question about client requesting the new feature. Ben, can you confirm?

If so, then I would like to see if we can put this in the queue for WGLC.

Thanks,
Michiko Short
Program Manager | Authentication Protocols
Operating Systems Group: OS Security

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 24 Jun 2015 17:45:03 -0400 (EDT)

> new feature. Ben, can you confirm?

Sorry for the delay; it took me longer than I expected to reconstruct the
history of the discussion.

For the curious: I raised the question in
http://www.ietf.org/mail-archive/web/kitten/current/msg05630.html of
whether we are okay requiring all clients implementing freshness token
support to implement the behavior of sending an empty PA_AS_FRESHNESS
padata in order to request a freshness token.  Michiko acknowledged this
in http://www.ietf.org/mail-archive/web/kitten/current/msg05645.html and
also mentioned two other options for ways for clients to get freshness
tokens, though I don't think either got much discussion.  (As described,
neither seems particularly appealing, so that seems fine.)

There was some follow-up discussion starting at
http://www.ietf.org/mail-archive/web/kitten/current/msg05665.html , where
Sam and Greg seem to agree that the proposed behavior (requiring the
clients to explicitly request a freshness token) is acceptable, with
varying degrees of enthusiasm.  There is still disagreement about whether
this sort of negotiation is required, but it seems clear that it is
permitted, and no one is raising blocking objections.

> If so, then I would like to see if we can put this in the queue for WGLC.

I agree.  I was hoping to get out a poll on what potential new work the WG
is interested in undertaking (and in what order) before starting the next
WGLC, but that seems to be taking much longer than I expected.  Stay tuned
for more...

-Ben