Subject: PKINIT-23 comments: section 3.2.3.1 ECDH support

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Sun, 6 Feb 2005 19:29:08 -0800

Current:

   1.  Both the KDC and the client calculate the shared secret value
      DHKey:

           DHKey = g^(xb * xa) mod p

      where xb and xa are the KDC's and client's private exponents,
      respectively.  DHKey, padded first with leading zeros as needed to
      make it as long as the modulus p, is represented as a string of
      octets in big-endian order (such that the size of DHKey in octets
      is the size of the modulus p).

New:

   1.  Both the KDC and the client calculate the shared secret value as
      follows:

      a) When Diffie-Hellman modulo a prime p ([RFC2631]) is used, let
         DHSharedSecret be the shared secret value.

      b) When Elliptic Curve Diffie-Hellman (ECDH) (with each party
         contributing one key pair) [IEEE1363] is used, let
         DHSharedSecret be the x-coordinate of the shared secret value
         (an elliptic curve point).

      DHSharedSecret is first padded with leading zeros such that the
      size of DHSharedSecret in octets is the same as that of the
      modulus, then represented as a string of octets in big-endian
      order.

      Implementation note: both the client and the KDC can cache the
      triple (ya, yb, DHSharedSecret), where ya and yb are the public
      key for the client and the KDC respectively.  If both ya and yb
      are the same in a later exchange, the cached DHSharedSecret can be
      used.

Also in section 3.2.2, the new text is:

   If the clientPublicValue is filled in, indicating that the client
   wishes to use the Diffie-Hellman key agreement method, the KDC SHOULD
   check to see if the key parameters satisfy its policy.  If they do
   not, it MUST return an error message with the code KDC_ERR_KEY_SIZE.
   The accompanying e-data is a TYPED-DATA that contains an element
   whose data-type is TD_DH_PARAMETERS, and whose data-value contains
   the DER encoding of the type TD-DH-PARAMETERS:

       TD-DH-PARAMETERS ::= SEQUENCE OF DHDomainParameters
                   -- Contains a list of Diffie-Hellman domain
                   -- parameters in decreasing preference order.

       DHDomainParameters ::= CHOICE {
           modp                   [0] DomainParameters,
                   -- Type DomainParameters is defined in [RFC3279].
           ec                     [1] EcpkParameters,
                   -- Type EcpkParameters is defined in [RFC3279].
           ...
       }

   TD-DH-PARAMETERS contains a list of Diffie-Hellman domain parameters
   that the KDC supports in decreasing preference order, from which the
   client SHOULD pick one to retry the request.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 07 Feb 2005 17:38:23 -0500

I think I'd like to see support from more than one vendor before
accepting the Ec DH changes.  I don't feel particularly strong about
this.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 7 Feb 2005 16:39:51 -0600

> accepting the Ec DH changes.  I don't feel particularly strong about

While I support the addition of ECDH support to PKINIT, I also think
that may be best done in a separate I-D.