Subject: RE: secdir review: draft-ietf-cat-kerberos-pk-init-30.txt

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 15 Dec 2005 16:18:51 -0800

Wow,  I love it. Can you change "PA-DATA element #0" to something more
accurate? It may not be element 0, in fact the order should not be
relevant if you have more than one preauth data element.

Also, is there a way to indicate either there are more fields in the
structures or the structures are extensible (having the ASN.1
extensibility marker)?

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Nicolas
Williams
Sent: Thursday, December 15, 2005 3:13 PM
To: [email-masked]; [email-masked]
Subject: Re: secdir review: draft-ietf-cat-kerberos-pk-init-30.txt

Some more ASCII art:

   +-------------------------+
   |AS-REQ                   |
   | +----------------------+|
   | |PA-DATA (pre-auth)    ||  +------------------------------------+
   | |+-------------------+ ||  |PA-PK-AS-REQ                        |
   | ||PA-DATA element #0 |---->| signedAuthPack                     |
   | ||                   | ||  | +-------------------------------+  |
   | |+-------------------+ ||  | |ContentInfo                    |  |
   | |..................... ||  | | contentType: id-signed-data   |  |
   | +----------------------+|  | | eConType: id-pkinit-authData  |  |
   | +----------------------+|  | | eContent: AuthPack--+         |  |
   | |AS-REQ-BODY           ||  | |                     |         |  |
   | | [cname], realm,      ||  | +---------------------|---------+, |
   | | [sname], [from],     ||  | [trustedCertifiers[]],|            |
   | | till, [rtime], nonce,||  | [kdcPkId]             |            |
   | | etype, [addresses],  ||  +-----------------------|------------+
   | | [enc-authz-data],    ||     ......................
   | | [additional-tickets] ||     |
   | +----------------------+|     |
   +-------------------------+     v
                  +----------------------------------------------+
                  |pkAuthenticator, clientPublicKeyValue,        |
                  || supportedCMSTypes, clientDHNonce            |
                  ||  +-----------------------------------------+|
                  |+->|PKAuthenticator                          ||
                  |   | cusec, ctime, nonce, paChecksum, ...    ||
                  |   +-----------------------------------------+|
                  +----------------------------------------------+

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 16 Dec 2005 00:46:32 -0600

> relevant if you have more than one preauth data element.

Sure.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 16 Dec 2005 19:21:51 -0600

Additional ASCII art follows.  Do with it what you like.

   Figure x: AS-REQ with PA-ENC-TIMESTAMP

   +--------------------------------+
   |AS-REQ                          |
   | +-----------------------------+|
   | |PA-DATA (pre-auth)           ||
   | |...........................  ||  +---------------------+
   | |+--------------------------+ ||  |EncryptedData        |
   | ||PA-DATA element #j        +---->| enctype, [kvno],    |
   | || pa-type: pa-enc-timestamp| ||  | +------------------+|
   | |+--------------------------+ ||  | |PA-ENC-TS         ||
   | |...........................  ||  | | patimestamp,     ||
   | +-----------------------------+|  | | pausec           ||
   | +-----------------------------+|  | +------------------+|
   | |AS-REQ-BODY                  ||  +---------------------+
   | | [cname], realm, [sname],    ||
   | | [from], till, [rtime],      ||
   | | nonce, etype, [addresses*], ||
   | | [{enc-authz-data}],         ||
   | | [additional-tickets*]       ||
   | +-----------------------------+|
   +--------------------------------+

   Figure x: AS and TGS replies

   +---------------------------+
   |KDC-REP                    |
   | padata*-+                 |
   |         v                 |
   |  +----------------------+ |
   |  |PA-DATA (pre-auth)    | |
   |  |..................... | |
   |  +----------------------+ |
   | crealm, cname, ticket,    |
   | +------------------------+|
   | |EncKDCRepPart           ||
   | | key, last-req*, nonce, ||
   | | [key-expiration],      ||
   | | flags, authtime,       ||
   | | [starttime], endtime,  ||
   | | [renew-till], srealm,  ||
   | | [caddr*]               ||
   | +------------------------+|
   +---------------------------+

   Figure x: AS-REQ with PKINIT

   +-------------------------+
   |AS-REQ                   |  +-----------------------------------+
   | +----------------------+|  |PA-PK-AS-REQ                       |
   | |PA-DATA (pre-auth)    ||  | signedAuthPack                    |
   | |..................... ||  | +-------------------------------+ |
   | |+-------------------+ ||  | |ContentInfo                    | |
   | ||PA-DATA element #j |---->| | contentType: id-signed-data   | |
   | ||                   | ||  | | eConType: id-pkinit-authData  | |
   | |+-------------------+ ||  | | eContent: AuthPack--+         | |
   | |..................... ||  | |                     |         | |
   | +----------------------+|  | +---------------------|---------+,|
   | +----------------------+|  | [trustedCertifiers*], | [kdcPkId],|
   | |AS-REQ-BODY           ||  | ... |                 |           |
   | | [cname], realm,      ||  +-----|-----------------|-----------+
   | | [sname], [from],     ||        |                 |
   | | till, [rtime], nonce,||        |                 v
   | | etype, [addresses*], ||        |  +--------------------------+
   | | [enc-authz-data*],   ||        |  |pkAuthenticator,          |
   | | [addit.-tickets*]    ||        |  || [clientPublicKeyValue], |
   | +----------------------+|        |  |  [supportedCMSTypes*],   |
   +-------------------------+        |  |  [clientDHNonce], ...    |
                                      |  ||  +---------------------+|
     +-----------------------+        |  ||  |PKAuthenticator      ||
     |ExternalPrincipalIdent |        |  |+->| cusec, ctime, nonce,||
     | [subjectName],        |<-------+  |   | paChecksum, ...     ||
     | [issuerAndSerial],    |           |   +---------------------+|
     | [subjectKeyIdent], ...|           +--------------------------+
     +-----------------------+

   Figure x: AS-REP with PKINIT

   +--------------------------+
   |AS-REP                    |
   | padata--+                |
   |         v                |
   |  +----------------------+|
   |  |..................... ||      +-------------------------+
   |  |+-------------------+ ||      |PA-PK-AS-REP             |
   |  ||PA-DATA element #j |-------->| dhInfo, encKeyPack      |
   |  ||                   | ||      +---+---------+-----------+
   |  |+-------------------+ ||          |         |
   |  |..................... ||          v         +-----------------+
   |  +----------------------+|   +-------------------------------+  |
   | crealm, cname, ticket,   |   |DHRepInfo                      |  |
   | +-----------------------+|   | dhSignedData, [serverDHNonce],|  |
   | |EncKDCRepPart          ||   | ... |                         |  |
   | | key, last-req, nonce, ||   |+----v----------------------+  |  |
   | | [key-expiration],     ||   ||ContentInfo                |  |  |
   | | flags, authtime,      ||   || cType: id-signed-data     |  |  |
   | | [starttime], endtime, ||   || eCTyp: id-pkinit-DHKeyData|  |  |
   | | [renew-till], srealm, ||   || eContent: KDCDHKeyInfo    |  |  |
   | | caddr                 ||   |+-------------|-------------+  |  |
   | +-----------------------+|   +--------------|----------------+  |
   +--------------------------+                  |                   |
                                +----------------+                   |
                                |                                    |
    +-----------------------+   |  +---------------------------+     |
    |subjecPublicKey, nonce,|<--+  |ContentInfo                |<----+
    |[dhKeyExpiration], ... |      | cType: id-signed-data     |
    +-----------------------+      | eCTyp: id-pkinit-rkeyData |
                                   | eContent: ReplyKeyPack    |
                                   +---------------|-----------+
            +-------------------+                  |
            |replyKey, checksum |<-----------------+
            +-------------------+

   Figure: Structure of a Kerberos V Ticket
     +-------------------------------------+
     |Ticket                               |
     | realm, sname, enc-part              |
     |                  |                  |
     |                  |                  |
     |                  v                  |
     | +---------------------------------+ |
     | |EncryptedData                    | |
     | | etype, kvno, cipher             | |
     | |                |                | |
     | |                |                | |
     | |                v                | |
     | | +------------------------------+| |
     | | |  EncTicketPart               || |
     | | |   flags, key, crealm, cname, || |
     | | |   transited, authtime,       || |
     | | |   [starttime], endtime,      || |
     | | |   [renew-till], [caddr*],    || |
     | | |   [authorization-data*]      || |
     | | +------------------------------+| |
     | +---------------------------------+ |
     +-------------------------------------+