Subject: PKINIT review comments

From: Jeffrey Hutzelman <[email-masked]>
Date: Sun, 25 Dec 2005 11:13:46 -0500

During my final review of PKINIT, I found one editorial issue and one 
technical one.

The editorial issue is that there are spurious references to RFC4121 
whenever "newer" enctypes are mentioned, even though that document adds no 
value to the definition in RFC4120 of the meaning of that usage.  If there 
is no objection, I think this can be fixed in the next version of the 
document, or in AUTH48.

The technical issue relates to algorithm agility.  I know we agreed to do 
the minimum necessary now in order to insure we will later be able to add 
new algorithms and a full negotiation mechanism.  However, there are two 
cases in which I'm not convinced that we've accomplished that.  Before we 
send this to the IESG, I'd like to either fix the two cases pointed out 
below, or have someone convince me that there's not a problem.

* As currently defined, paChecksum is REQUIRED to be SHA-1.  I see no
  mechanism for indicating what algorithm is in use, and no mechanism
  for a KDC to indicate that a client has used an algorithm which it
  does not support or is configured not to accept.  At a minimum, it
  needs to be possible to modify the protocol in the future to allow
  for algorithm agility in a backward-compatible fashion.  Ideally,
  we should be specifying a way to use SHA-256 today.

* An error KDC_ERR_HASH_IN_KDF_NOT_ACCEPTED is defined to be returned
  "If the hash algorithm used in the key derivation function is not
  acceptable by the KDC".  However, the only algorithm currently defined
  is SHA-1, and there is no mechanism defined for negotiating an algorithm
  to use or indicating which algorithm is in use -- if the KDC and client
  do not magically use the same algorithm, they will simply compute
  different reply keys and the exchange will mysteriously fail.

-- Jeff