Subject: RE: PKINIT-31, text arts

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 21 Dec 2005 13:34:25 -0800

Chaskiel M Grundman wrote:
> I'm not sure the mention of PFS is a good idea.

I was trying to cite reasons why people want to depoly PKI, once PKI is
depoled, it makes sense to use PKINIT.

 it was certainly not my intention to imply you can get PFS out of
PKINIT.

I can yank that word out if that you feel strong against it, I certainly
have thrown some buzzy words there, perhaps more than necessary.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Chaskiel M
Grundman
Sent: Wednesday, December 21, 2005 12:08 PM
To: [email-masked]
Subject: Re: PKINIT-31, text arts

--On Wednesday, December 21, 2005 09:52:11 -0800 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> Section 1 is replcated with the following and Nico's test arts are 
> included. Please review. Thanks.

Wow. I like this text a lot.  (I'm not sure I think that
kerberos-in-a-nutshell needs to be in this document, but others do. The
'justification' for pkinit is needed, and is much clearer now)

I'm not sure the mention of PFS is a good idea. while there is PFS of
the reply key when DH is used, the rest of kerberos does not provide PFS
for TGS or service key compromises. We shouldn't suggest otherwise, even
indirectly.