CAMMAC extensibility options

With the pubkey-signature field removed, AD-CAMMAC looks like:

    AD-CAMMAC                   ::= SEQUENCE {
          kdc-signature         [0] Checksum,
          svc-signature         [1] Checksum,
          trusted-svc-signature [2] OPT-Checksum OPTIONAL,
          elements              [3] AuthorizationData
    }

In the interim meeting, we determined that we want to be able to add
new verifiers somehow.  Here are the basic options I can see:

1. Put a ", ..." at the end of that sequence.  Then we can add new
fields through standards action, one at a time.

Aesthetically, it's a little weird to have some verifiers before the
elements and some after, so maybe we'd move the elements to the front.

2. Tom raised the preference that we have verifiers (including ones
added later) before elements, so that one could compute the checksums
over the elements in one pass over the DER encoding.  I can't really
conceive of a scenario where someone would want streamy processing of
authorization data, but if this is a requirement, we would need
something like:

    AD-CAMMAC                   ::= SEQUENCE {
          verifiers             [0] CAMMACVerifiers,
          elements              [1] AuthorizationData
    }

    CAMMACVerifiers             ::= SEQUENCE {
          kdc-signature         [0] Checksum,
          svc-signature         [1] Checksum,
          trusted-svc-signature [2] OPT-Checksum OPTIONAL,
          ...
    }

3. Simo and Tom both raised the idea of creating a number space of
verifier types, which might result in something like like:

    AD-CAMMAC                   ::= SEQUENCE {
          verifiers             [0] SEQUENCE OF CAMMACVerifier,
          elements              [1] AuthorizationData
    }

    CAMMACVerifier              ::= SEQUENCE {
          verifier-type         [0] INTEGER,
          [something goes here]
    }

(kdc-signature and svc-signature might remain broken out ahead of
verifiers.)  I think it's too heavyweight to create a number space and
typed hole for this purpose, though.
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg