Re: Last Call: 'Kerberized Internet Negotiation of Keys (KINK)' to Proposed Standard (fwd)

--==========881E0FBAAA85F7842946==========
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline



--On Tuesday, November 29, 2005 12:41:38 -0600 Nicolas Williams=20
<[email protected]> wrote:

>  - Sub-session key generation.
>
>    Section 3.2.1 says that "... KINK takes advantage of the fact that
>    the KDC provides a reliable source of randomness which is used in key
>    derivation."  But there's no prescribed mechanism by which Kerberos V
>    clients are to include KDC-provided entropy into the sub-session key
>    generation, nor is there any text saying that clients MAY/SHOULD/MUST
>    do this in some, presumably, implementation dependent manner.

kink actually proscribes the use of sub-session keys:

4 KINK Message Format[....]
  o  Cksum (variable) -- Kerberos keyed checksum over the entire
      message excluding the Cksum field itself.[...] The key used
      MUST be the session key in the ticket.

7 ISAKMP Key Derivation [....]

o  SKEYID_d is the session key in the Kerberos service ticket from
      the AP-REQ.  Note that subkeys are not used in KINK and MUST be
      ignored if received.

This issue has been discussed in the past (multiple times even), and=20
bringing it up again will probably not result in anything other than wasted =

time.


I did notice that section 4.2.7 KINK_ENCRYPT does not specify what key is=20
used, only that it
"is encrypted using the encryption algorithm specified by the etype of the=20
session key"
--==========881E0FBAAA85F7842946==========
Content-Type: application/pkcs7-signature
Content-Transfer-Encoding: base64

MIIL1wYJKoZIhvcNAQcCoIILyDCCC8QCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3
DQEHAaCCCVswggLjMIICTKADAgECAgMO/8kwDQYJKoZIhvcNAQEEBQAwYjELMAkG
A1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4x
LDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4X
DTA1MDYyMzE3MzEzMFoXDTA2MDYyMzE3MzEzMFowRTEfMB0GA1UEAxMWVGhhd3Rl
IEZyZWVtYWlsIE1lbWJlcjEiMCAGCSqGSIb3DQEJARYTY2cydkBhbmRyZXcuY211
LmVkdTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALujtch96NHbplBs
5DnSTn03EsnbYsLng/wM+wbfyS6ml6CCGYl7HY+sIBm4DNygpyQz0mvtvy9kKz7V
M2GTYdH5QLOgxxPxzV3fItv4jF9LKr9tIiT+v9K7XQ2Xl4kDyJi1g19UsKU4wf+s
uFdennXZ0pkWTpUld9JRZiLSYQDs/Hi62OekBfIX+H96AskyMBhZj5OVA+CYtnCj
fzVYO4a/RoAmemQhlv+whF0Qa3QFrLZtrDXKeYX95KU78q6+cJqtiAri4H3k8NpD
SeWavUxFyH/PFhCYPVdfVDiwaTwfEI5lBF0vTTTL8kSnJSmRBRWw9RkYHNZ8hxBC
Oo9m1oMCAwEAAaNAMD4wDgYDVR0PAQH/BAQDAgXgMB4GA1UdEQQXMBWBE2NnMnZA
YW5kcmV3LmNtdS5lZHUwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQQFAAOBgQCR
W9k/ckGNAJQ+DeUey0Hed2nlQb4goaakkHviC70vAVt0N34yrk3uxBf5Kch2olqM
SMCR+9+b1iXn0NU9n7QppayQ7SsYci3m8eMlaBk1pK91LrHGQL+ZEqOPqwhRmb0a
lQFAAoJpJdotCBzy0X1GP83i+2DUdT6ydPlmtsm8djCCAz8wggKooAMCAQICAQ0w
DQYJKoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJu
IENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1
bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24x
JDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3
DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcwMDAw
MDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3
dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29u
YWwgRnJlZW1haWwgSXNzdWluZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
gYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me7L3N9VvyGna9fww6YfK/Uc4B1OVQ
CjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQqE88r1fOCdz0Dviv+uxg+
B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCBkTAS
BgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwu
dGhhd3RlLmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQE
AwIBBjApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgw
DQYJKoZIhvcNAQEFBQADgYEASIzRUIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4
+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6EsZkbAMUaC4J0niVQlGLH2ydxVyWN
3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341YheILcIRk13iSx0x1G/11f
ZU8wggMtMIIClqADAgECAgEAMA0GCSqGSIb3DQEBBAUAMIHRMQswCQYDVQQGEwJa
QTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAY
BgNVBAoTEVRoYXd0ZSBDb25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9u
IFNlcnZpY2VzIERpdmlzaW9uMSQwIgYDVQQDExtUaGF3dGUgUGVyc29uYWwgRnJl
ZW1haWwgQ0ExKzApBgkqhkiG9w0BCQEWHHBlcnNvbmFsLWZyZWVtYWlsQHRoYXd0
ZS5jb20wHhcNOTYwMTAxMDAwMDAwWhcNMjAxMjMxMjM1OTU5WjCB0TELMAkGA1UE
BhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3du
MRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNh
dGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFs
IEZyZWVtYWlsIENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0
aGF3dGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDUadfUsJRkW3Hp
R9gMUbbqcpGwhF59LQ2PexLfhSV1KHQ6QixjJ5+Ve0vvfhmHHYbqo925zpZkGsIU
bkSsfOaP6E0PcR9AOKYAo4d49vmUhl6t6sBeduvZFKNdbnp8DKVLVX8GGSl/npom
1Wq7OCQIapjHsdqjmJH9edvlWsQcuQIDAQABoxMwETAPBgNVHRMBAf8EBTADAQH/
MA0GCSqGSIb3DQEBBAUAA4GBAMfskn5O+PWWpWdiKqTwTRFg0G+NYFhhrCa7UjVc
CM8w+6hKloofYkIjjBcP9LpknBesRynfnZhe0mxgcVyirNx54+duAEcftQ0o6AKd
5Jr9E/Sm2Xyx+NxfIyYJkYBz0BQb3kOpgyXy5pwvFcr+pquKB3WLDN1RhGvk+NHO
d6KBMYICRDCCAkACAQEwaTBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3Rl
IENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFs
IEZyZWVtYWlsIElzc3VpbmcgQ0ECAw7/yTAJBgUrDgMCGgUAoIGxMBgGCSqGSIb3
DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA1MTEyOTIwNTc0OVow
IwYJKoZIhvcNAQkEMRYEFJMMYwwItrrezNEXNWrFvyCib5lZMFIGCSqGSIb3DQEJ
DzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFA
MAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBABIlEGFU
VbszKSlSs2s0MeOqqLdaAsYsB+kIpfHog6hqF0q0IeumcELsL8XPHl346PYGDlud
KjQPa3y7FxRBINp8ODg9aoFoZluns+u0Y27N2SwlBfaPCWafFYwrdEHG66JZtNBC
tCV610pujjlrl8bYFTFLrVAEGYuDkvPmDBy8xH2b0ThOVFGHkipoQk96+GusUlR9
tVC2qZsux2raBXmyqS2T4OJN9CysQIx3zn9xH1tM41rSB16+Hgy4gIwBEv+zH4cu
u1tdWx9VAFSRAtkWs+hkCEx6uowv8VL+d6CYuNrmtOYwRNTb1ePYbxJZZpT81+HT
eN0PQB7Nx6CuUSc=

--==========881E0FBAAA85F7842946==========--