From mpei@verisign.com Thu Dec 17 18:41:26 2009 Return-Path: X-Original-To: keyprov@core3.amsl.com Delivered-To: keyprov@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9D9CD3A6853 for ; Thu, 17 Dec 2009 18:41:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.109 X-Spam-Level: X-Spam-Status: No, score=-5.109 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3-ByB3e3khjv for ; Thu, 17 Dec 2009 18:41:25 -0800 (PST) Received: from robin.verisign.com (robin.verisign.com [65.205.251.75]) by core3.amsl.com (Postfix) with ESMTP id 324B83A6826 for ; Thu, 17 Dec 2009 18:41:25 -0800 (PST) Received: from MOU1WNEXCN02.vcorp.ad.vrsn.com (mailer2.verisign.com [65.205.251.35]) by robin.verisign.com (8.12.11/8.13.4) with ESMTP id nBI2en96003077; Thu, 17 Dec 2009 18:41:05 -0800 Received: from MOU1WNEXMB10.vcorp.ad.vrsn.com ([10.25.13.204]) by MOU1WNEXCN02.vcorp.ad.vrsn.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 17 Dec 2009 18:41:02 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----_=_NextPart_001_01CA7F8B.8916A0FC" Date: Thu, 17 Dec 2009 18:40:59 -0800 Message-ID: <3E5A2F1AD44F5E49A74F79AB47C0C0C9015D0E70@mou1wnexmb10.vcorp.ad.vrsn.com> In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: draft-ietf-keyprov-pskc PSKC draft 04 Thread-Index: AcpvfCC2M55KvR0YSbGF78TFbpqJ0QQCm94w References: From: "Pei, Mingliang" To: "Dan Smith" , X-OriginalArrivalTime: 18 Dec 2009 02:41:02.0382 (UTC) FILETIME=[89DFFCE0:01CA7F8B] Cc: oath_technical@v2.listbox.com, KEYPROV Subject: Re: [KEYPROV] draft-ietf-keyprov-pskc PSKC draft 04 X-BeenThere: keyprov@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Provisioning of Symmetric Keys \(keyprov\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Dec 2009 02:41:26 -0000 This is a multi-part message in MIME format. ------_=_NextPart_001_01CA7F8B.8916A0FC Content-Type: multipart/alternative; boundary="----_=_NextPart_002_01CA7F8B.8916A0FC" ------_=_NextPart_002_01CA7F8B.8916A0FC Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Dan, =20 Thank you very much for reviewing and verifying the data in PSKC draft. Sorry for the delayed following up. Please see my comments inline. =20 - Ming ________________________________ From: Dan Smith [mailto:Daniel.Smith@entrust.com]=20 Sent: Friday, November 27, 2009 8:10 AM To: 'draft-ietf-keyprov-pskc@tools.ietf.org' Subject: draft-ietf-keyprov-pskc PSKC draft 04 =09 =09 Hi there, =20 I have a few quick comments on the samples included in the PSKC draft at http://tools.ietf.org/html/draft-ietf-keyprov-pskc-04. =20 Section 6.1. Encryption based on Pre-Shared Keys =20 The text says "The name of the pre-secret is "Example-Key1", as set in the element", but in the actual XML the key name is set to Pre-shared-key: Pre-shared-key =09 [Pei, Mingliang] Good catch. We will add this into revision list. =20 In the example message in 6.1, what is the value MAC calculated on? I can come up with the same elements, but I cannot figure out how to compute the . In the example in message 6.2, the value MAC is calculated on the bytes inside the element that contains the encrypted key, but this doesn't appear to be the case in the example in 6.1. =20 [Pei, Mingliang] ValueMAC should be computed over the encrypted value. See section 4.1. We will double check the values. =20 Section 6.2. Encryption based on Passphrase-based Keys For the example in this section, I can compute the same containing the encrypted key and the same as shown in the example. However, I cannot compute the same for the encrypted MAC key. I think the value shown is wrong. The IV + encrypted MAC key in the example is 64 bytes long, but a 16 byte IV and 20 bytes encrypted using AES-128-CBC should give 16+32 =3D 48 bytes of data. =09 [Pei, Mingliang] You are right, it should be 48 bytes. My examples show 48 byte too. See attached. It will be great if you could verify the attached example. I will trace down how the version of value gets into the example in the doc. Thanks. =20 Other than this, thanks for including the real examples in the draft, they have been very helpful. =20 Dan Smith Software Developer Entrust =20 ------_=_NextPart_002_01CA7F8B.8916A0FC Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Hi Dan,
 
Thank you very much for reviewing and verifying = the data in=20 PSKC draft. Sorry for the delayed following up. Please see my comments=20 inline.
 
- Ming

From: Dan Smith=20 [mailto:Daniel.Smith@entrust.com]
Sent: Friday, November = 27, 2009=20 8:10 AM
To:=20 'draft-ietf-keyprov-pskc@tools.ietf.org'
Subject:=20 draft-ietf-keyprov-pskc PSKC draft 04

Hi=20 there,
 
I = have a few quick=20 comments on the samples included in the PSKC draft at http://too= ls.ietf.org/html/draft-ietf-keyprov-pskc-04.
 
Section 6.1.=20 Encryption based on Pre-Shared Keys
 
The = text says "The=20 name of the pre-secret is "Example-Key1", as set in the = <KeyName>=20 element", but in the actual XML the key name is set to=20 Pre-shared-key:
    =20 = <EncryptionKey>
        = =20 = <ds:KeyName>Pre-shared-key</ds:KeyName>
   =  =20 </EncryptionKey>

[Pei, Mingliang] Good catch. = We will add this=20 into revision list.
 
In the example message in = 6.1, what=20 is the value MAC calculated on? I can come up with the same=20 <CipherValue> elements, but I cannot figure out how to compute = the=20 <ValueMAC>. In the example in message 6.2, the value MAC is = calculated=20 on the bytes inside the <xenc:CipherValue> element that contains = the=20 encrypted key, but this doesn't appear to be the case in the example = in=20 6.1.
 
[Pei, Mingliang]  ValueMAC should be = computed over the=20 encrypted value. See section 4.1. We will double check the=20 values.
 
Section 6.2.=20 Encryption based on Passphrase-based Keys
For the=20 example in this section, I can compute the same <CipherValue> = containing=20 the encrypted key and the same <ValueMAC> as shown in the = example.=20 However, I cannot compute the same <CipherValue> for the = encrypted=20 MAC key. I think the value shown is wrong. The IV + encrypted MAC key = in the=20 example is 64 bytes long, but a 16 byte IV and 20 bytes encrypted = using=20 AES-128-CBC should give 16+32 =3D 48 bytes of data.
[Pei, = Mingliang]  You=20 are right, it should be 48 bytes. My examples show 48 byte too. See = attached.=20 It will be great if you could verify the attached example. I will = trace=20 down how the version of value gets into the example in the doc.=20 Thanks.
 
Other than this,=20 thanks for including the real examples in the draft, they have been = very=20 helpful.
 
Dan=20 Smith
Software=20 Developer
Entrust
 

------_=_NextPart_002_01CA7F8B.8916A0FC-- ------_=_NextPart_001_01CA7F8B.8916A0FC Content-Type: text/xml; name="KeyContainerWithPBE.xml" Content-Transfer-Encoding: base64 Content-Description: KeyContainerWithPBE.xml Content-Disposition: attachment; filename="KeyContainerWithPBE.xml" PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pgo8 cHNrYzpLZXlDb250YWluZXIgeG1sbnM6cHNrYz0idXJuOmlldGY6cGFyYW1zOnhtbDpuczprZXlw cm92OnBza2MiIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIiB4 bWxuczp4ZW5jPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyMiIHhtbG5zOmRrZXk9 Imh0dHA6Ly93d3cudzMub3JnLzIwMDkveG1sc2VjLWRlcml2ZWRrZXkjIiB4bWxuczpwa2NzNT0i aHR0cDovL3d3dy5yc2FzZWN1cml0eS5jb20vcnNhbGFicy9wa2NzL3NjaGVtYXMvcGtjcy01djIt MCMiIFZlcnNpb249IjEuMCIgSWQ9IktDMDAwMiI+CiAgICA8cHNrYzpFbmNyeXB0aW9uS2V5Pgog ICAgICAgIDxka2V5OkRlcml2ZWRLZXk+CiAgICAgICAgICAgIDxka2V5OktleURlcml2YXRpb25N ZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnJzYXNlY3VyaXR5LmNvbS9yc2FsYWJzL3BrY3Mv c2NoZW1hcy9wa2NzLTV2Mi0wI3Bia2RmMiI+CiAgICAgICAgICAgICAgICA8cGtjczU6UEJLREYy LXBhcmFtcz4KICAgICAgICAgICAgICAgICAgICA8U2FsdD4KICAgICAgICAgICAgICAgICAgICAg ICAgPFNwZWNpZmllZD5FajcvUEVweUVwdz08L1NwZWNpZmllZD4KICAgICAgICAgICAgICAgICAg ICA8L1NhbHQ+CiAgICAgICAgICAgICAgICAgICAgPEl0ZXJhdGlvbkNvdW50PjEwMDA8L0l0ZXJh dGlvbkNvdW50PgogICAgICAgICAgICAgICAgICAgIDxLZXlMZW5ndGg+MTY8L0tleUxlbmd0aD4K ICAgICAgICAgICAgICAgIDwvcGtjczU6UEJLREYyLXBhcmFtcz4KICAgICAgICAgICAgPC9ka2V5 OktleURlcml2YXRpb25NZXRob2Q+CiAgICAgICAgICAgIDx4ZW5jOlJlZmVyZW5jZUxpc3Q+CiAg ICAgICAgICAgICAgICA8eGVuYzpEYXRhUmVmZXJlbmNlIFVSST0iI0VEIi8+CiAgICAgICAgICAg IDwveGVuYzpSZWZlcmVuY2VMaXN0PgogICAgICAgICAgICA8ZGtleTpNYXN0ZXJLZXlOYW1lPlBh c3NwaHJhc2UxPC9ka2V5Ok1hc3RlcktleU5hbWU+CiAgICAgICAgPC9ka2V5OkRlcml2ZWRLZXk+ CiAgICA8L3Bza2M6RW5jcnlwdGlvbktleT4KICAgIDxwc2tjOk1BQ01ldGhvZCBBbGdvcml0aG09 Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNobWFjLXNoYTEiPgogICAgICAgIDxw c2tjOk1BQ0tleT4KICAgICAgICAgICAgPHhlbmM6RW5jcnlwdGlvbk1ldGhvZCBBbGdvcml0aG09 Imh0dHA6Ly93d3cucnNhc2VjdXJpdHkuY29tL3JzYWxhYnMvcGtjcy9zY2hlbWFzL3BrY3MtNSNw YmVzMiI+CiAgICAgICAgICAgICAgICA8cHNrYzpFbmNyeXB0aW9uU2NoZW1lIEFsZ29yaXRobT0i aHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjYWVzMTI4LWNiYyIvPgogICAgICAgICAg ICA8L3hlbmM6RW5jcnlwdGlvbk1ldGhvZD4KICAgICAgICAgICAgPHhlbmM6Q2lwaGVyRGF0YT4K ICAgICAgICAgICAgICAgIDx4ZW5jOkNpcGhlclZhbHVlPjJHVFRuTHdNM0k0ZTVJTzVGa3Vmb09F aU9oTmo5MWZoS1JRQnRCSllsdVVEc1BPTFRmVXZvVTJkU3R5T3dZWng8L3hlbmM6Q2lwaGVyVmFs dWU+CiAgICAgICAgICAgIDwveGVuYzpDaXBoZXJEYXRhPgogICAgICAgIDwvcHNrYzpNQUNLZXk+ CiAgICA8L3Bza2M6TUFDTWV0aG9kPgogICAgPHBza2M6S2V5UGFja2FnZT4KICAgICAgICA8cHNr YzpEZXZpY2VJbmZvPgogICAgICAgICAgICA8cHNrYzpNYW51ZmFjdHVyZXI+VG9rZW5WZW5kb3JB Y21lPC9wc2tjOk1hbnVmYWN0dXJlcj4KICAgICAgICAgICAgPHBza2M6U2VyaWFsTm8+OTg3NjU0 MzIxPC9wc2tjOlNlcmlhbE5vPgogICAgICAgICAgICA8cHNrYzpTdGFydERhdGU+MjAwOS0wOS0w MVo8L3Bza2M6U3RhcnREYXRlPgogICAgICAgICAgICA8cHNrYzpFeHBpcnlEYXRlPjIwMTQtMDkt MDFaPC9wc2tjOkV4cGlyeURhdGU+CiAgICAgICAgPC9wc2tjOkRldmljZUluZm8+CiAgICAgICAg PHBza2M6Q3J5cHRvTW9kdWxlSW5mbz4KICAgICAgICAgICAgPHBza2M6SWQ+Q01fSURfMDAxPC9w c2tjOklkPgogICAgICAgIDwvcHNrYzpDcnlwdG9Nb2R1bGVJbmZvPgogICAgICAgIDxwc2tjOktl eSBJZD0iTUJLMDAwMDAwMDAxIiBBbGdvcml0aG09InVybjppZXRmOnBhcmFtczp4bWw6bnM6a2V5 cHJvdjpwc2tjI2hvdHAiPgogICAgICAgICAgICA8cHNrYzpJc3N1ZXI+RXhhbXBsZS1Jc3N1ZXI8 L3Bza2M6SXNzdWVyPgogICAgICAgICAgICA8cHNrYzpBbGdvcml0aG1QYXJhbWV0ZXJzPgogICAg ICAgICAgICAgICAgPHBza2M6UmVzcG9uc2VGb3JtYXQgTGVuZ3RoPSI2IiBFbmNvZGluZz0iREVD SU1BTCIvPgogICAgICAgICAgICA8L3Bza2M6QWxnb3JpdGhtUGFyYW1ldGVycz4KICAgICAgICAg ICAgPHBza2M6RGF0YT4KICAgICAgICAgICAgICAgIDxwc2tjOlNlY3JldD4KICAgICAgICAgICAg ICAgICAgICA8cHNrYzpFbmNyeXB0ZWRWYWx1ZT4KICAgICAgICAgICAgICAgICAgICAgICAgPHhl bmM6RW5jcnlwdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cucnNhc2VjdXJpdHkuY29t L3JzYWxhYnMvcGtjcy9zY2hlbWFzL3BrY3MtNSNwYmVzMiI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8cHNrYzpFbmNyeXB0aW9uU2NoZW1lIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5v cmcvMjAwMS8wNC94bWxlbmMjYWVzMTI4LWNiYyIvPgogICAgICAgICAgICAgICAgICAgICAgICA8 L3hlbmM6RW5jcnlwdGlvbk1ldGhvZD4KICAgICAgICAgICAgICAgICAgICAgICAgPHhlbmM6Q2lw aGVyRGF0YT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx4ZW5jOkNpcGhlclZhbHVlPm9U dm8rUzIybnNtUzJaL1J0Y29GOEhmaCtqek1lMFJraWFmcG9EcG5vWlRqUFladTZWK0E0YUVuMDMy eUNyNGY8L3hlbmM6Q2lwaGVyVmFsdWU+CiAgICAgICAgICAgICAgICAgICAgICAgIDwveGVuYzpD aXBoZXJEYXRhPgogICAgICAgICAgICAgICAgICAgIDwvcHNrYzpFbmNyeXB0ZWRWYWx1ZT4KICAg ICAgICAgICAgICAgICAgICA8cHNrYzpWYWx1ZU1BQz5MUDZ4TXZqdHlwYmZUOVBka0poQlorRDZP NHc9PC9wc2tjOlZhbHVlTUFDPgogICAgICAgICAgICAgICAgPC9wc2tjOlNlY3JldD4KICAgICAg ICAgICAgICAgIDxwc2tjOkNvdW50ZXI+CiAgICAgICAgICAgICAgICAgICAgPHBza2M6UGxhaW5W YWx1ZT4wPC9wc2tjOlBsYWluVmFsdWU+CiAgICAgICAgICAgICAgICA8L3Bza2M6Q291bnRlcj4K ICAgICAgICAgICAgPC9wc2tjOkRhdGE+CiAgICAgICAgICAgIDxwc2tjOlBvbGljeT4KICAgICAg ICAgICAgICAgIDxwc2tjOktleVVzYWdlPk9UUDwvcHNrYzpLZXlVc2FnZT4KICAgICAgICAgICAg PC9wc2tjOlBvbGljeT4KICAgICAgICA8L3Bza2M6S2V5PgogICAgPC9wc2tjOktleVBhY2thZ2U+ CjwvcHNrYzpLZXlDb250YWluZXI+Cg== ------_=_NextPart_001_01CA7F8B.8916A0FC-- From mpei@verisign.com Thu Dec 17 18:56:08 2009 Return-Path: X-Original-To: keyprov@core3.amsl.com Delivered-To: keyprov@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D4FBC3A67A8 for ; Thu, 17 Dec 2009 18:56:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.852 X-Spam-Level: X-Spam-Status: No, score=-4.852 tagged_above=-999 required=5 tests=[AWL=-0.257, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, TRACKER_ID=2.003] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PC4wd7nj6dSH for ; Thu, 17 Dec 2009 18:56:07 -0800 (PST) Received: from robin.verisign.com (robin.verisign.com [65.205.251.75]) by core3.amsl.com (Postfix) with ESMTP id 527193A680D for ; Thu, 17 Dec 2009 18:56:04 -0800 (PST) Received: from mou1wnexcn01.vcorp.ad.vrsn.com (mailer1.verisign.com [65.205.251.34]) by robin.verisign.com (8.12.11/8.13.4) with ESMTP id nBI2teYo003789; Thu, 17 Dec 2009 18:55:40 -0800 Received: from MOU1WNEXMB10.vcorp.ad.vrsn.com ([10.25.13.204]) by mou1wnexcn01.vcorp.ad.vrsn.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 17 Dec 2009 18:55:40 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01CA7F8D.94EAAF42" Date: Thu, 17 Dec 2009 18:55:38 -0800 Message-ID: <3E5A2F1AD44F5E49A74F79AB47C0C0C9015D0E74@mou1wnexmb10.vcorp.ad.vrsn.com> In-Reply-To: <065171DAC4F2674EA8C1142A1AF8E7C31546AE7B@mou1wnexmb10.vcorp.ad.vrsn.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: MAC cipher value mismatch (RE: New version of PSKC) Thread-Index: AcooAHlzUFYGcolgTzSpURpFcJPFOQDjyHAAFP8r8XA= References: <5BFE9E473DBFC24CA87F18F29B3F0AC403EB7A6B@sur-corp-ex-02.corp.ad.activcard.com> <065171DAC4F2674EA8C1142A1AF8E7C31546AE7B@mou1wnexmb10.vcorp.ad.vrsn.com> From: "Pei, Mingliang" To: "Philip Hoyer" , , "Phillip Hallam-Baker" , "Salah Machani" , "Sean Turner" X-OriginalArrivalTime: 18 Dec 2009 02:55:40.0581 (UTC) FILETIME=[95528550:01CA7F8D] Cc: =?iso-8859-1?Q?Magnus_Nystr=F6m?= , "Doherty, Andrea" , Dan Smith , KEYPROV Subject: [KEYPROV] MAC cipher value mismatch (RE: New version of PSKC) X-BeenThere: keyprov@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Provisioning of Symmetric Keys \(keyprov\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Dec 2009 02:56:08 -0000 This is a multi-part message in MIME format. ------_=_NextPart_001_01CA7F8D.94EAAF42 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi Philip, =20 Dan pointed out the error in the example of spec v04, and I tried to = figure out where it was missed. I did provide the correct value as seen = in this email from 9/1. It looks that the last version didn't pick up = this change as needed. I assume that there will be another update before = the final RFC publish. Let us include this change in the final version. =20 Thanks, =20 - Ming ________________________________ From: Pei, Mingliang=20 Sent: Tuesday, September 01, 2009 10:44 PM To: Philip Hoyer; Hannes.Tschofenig@gmx.net; Phillip Hallam-Baker; = Salah Machani; Sean Turner Cc: Doherty, Andrea; Magnus Nystr=F6m; KEYPROV Subject: RE: New version of PSKC =09 =09 Hi Philip, =20 Please see the forwarded email that includes the examples from my = implementation that I sent earlier. The latest draft doesn't seem to = have the CipherValue for the MAC key right. Please update it to =20 2GTTnLwM3I4e5IO5FkufoOEiOhNj91fhKRQBtBJYluUDsPOLTfUvoU2dStyOwYZx =20 Thanks, =20 - Ming ________________________________ From: Philip Hoyer [mailto:phoyer@actividentity.com]=20 Sent: Friday, August 28, 2009 9:56 AM To: Hannes.Tschofenig@gmx.net; Phillip Hallam-Baker; Pei, Mingliang; = Salah Machani; Sean Turner Cc: Doherty, Andrea; Magnus Nystr=F6m; KEYPROV Subject: New version of PSKC =09 =09 Ladies and Gentlemen, Please find attached the new version of PSKC. =20 Changes: =20 * incorporated all of the feedback from Andrea and Sean.=20 * reference name change to the new DerivedKey element (moved to = XMLEnc11)=20 * Corrected AES example to include (prepend) IV inline with XMLENC = spec and mentions IV handling.=20 =20 I have one big problem: =20 The samples that Ming sent out for PBE and RSA do not match the ones = in the spec. =20 Especially the PBE is different form the one Ming already says was = corrected. =20 Based on the new XML Enc 1.1 spec for PBE and DerivedKeys. Are we sure = we are aligned here? =20 This is the only thing that needs to be clarified. =20 Otherwise, What do I need to do now. =20 Do I just submit or send to Russ and Pasi directly? =20 Philip =20 =20 ________________________________ =20 Philip Hoyer=20 =20 Senior Architect - Office of CTO =20 ActivIdentity (UK) 117 Waterloo Road London SE1 8UL =20 Telephone: +44 (0) 20 7960 0220 Fax: +44 (0) 20 7902 1985 =20 Private and confidential: This message and any attachments may contain privileged / confidential information. If you are not an intended = recipient, you must not copy, distribute, discuss or take any action in reliance = on it. If you have received this communication in error, please notify the = sender and delete this message immediately. =20 ------_=_NextPart_001_01CA7F8D.94EAAF42 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hi Philip,
 
Dan pointed out the error in the example of = spec v04, and I=20 tried to figure out where it was missed. I did provide the = correct=20 value as seen in this email from 9/1. It looks that the last version = didn't pick=20 up this change as needed. I assume that there will be another update = before the=20 final RFC publish. Let us include this change in the final=20 version.
 
Thanks,
 
- Ming

From: Pei, Mingliang =
Sent: Tuesday,=20 September 01, 2009 10:44 PM
To: Philip Hoyer;=20 Hannes.Tschofenig@gmx.net; Phillip Hallam-Baker; Salah Machani; Sean=20 Turner
Cc: Doherty, Andrea; Magnus Nystr=F6m;=20 KEYPROV
Subject: RE: New version of = PSKC

Hi Philip,
 
Please see the forwarded email that includes = the examples=20 from my implementation that I sent earlier. The latest draft doesn't = seem to=20 have the CipherValue for the MAC key right. Please update it=20 to
 
2GTTnLwM3I4e5IO5FkufoOEiOhNj91fhKRQBtBJYluUDsP= OLTfUvoU2dStyOwYZx
 
Thanks,
 
- Ming

From: Philip Hoyer=20 [mailto:phoyer@actividentity.com]
Sent: Friday, August = 28, 2009=20 9:56 AM
To: Hannes.Tschofenig@gmx.net; Phillip = Hallam-Baker; Pei,=20 Mingliang; Salah Machani; Sean Turner
Cc: Doherty, Andrea; = Magnus=20 Nystr=F6m; KEYPROV
Subject: New version of = PSKC

Ladies and=20 Gentlemen,

Please find attached = the new=20 version of PSKC.

 

Changes:

 

  • incorporated all of = the=20 feedback from Andrea and Sean.=20
  • reference name = change to the=20 new DerivedKey element (moved to = XMLEnc11)=20
  • Corrected AES = example to=20 include (prepend) IV inline with XMLENC spec and mentions IV=20 handling.

 

I have one big=20 problem:

 

The samples that Ming = sent out=20 for PBE and RSA do not match the ones in the=20 spec.

 

Especially the PBE is = different=20 form the one Ming already says was = corrected.

 

Based on the new XML = Enc 1.1=20 spec for PBE and DerivedKeys. Are we sure we are aligned=20 here?

 

This is the only thing = that=20 needs to be clarified.

 

Otherwise,

What do I need to do=20 now.

 

Do I just submit or = send to Russ=20 and Pasi directly?

 

Philip

 

 

________________________________

 

Philip Hoyer=20

 

Senior = Architect -=20 Office of CTO

 

ActivIdentity=20 (UK)=

117 Waterloo=20 Road

London SE1=20 8UL

 

Telephone: +44 = (0) 20=20 7960 0220

Fax: +44 (0) = 20 7902=20 1985

 

Private and=20 confidential: This message and any attachments may=20 contain

privileged /=20 confidential information. If you are not an intended=20 recipient,

you must not = copy,=20 distribute, discuss or take any action in reliance on=20 it.

If you have = received=20 this communication in error, please notify the=20 sender

and delete = this message=20 immediately.

 

= ------_=_NextPart_001_01CA7F8D.94EAAF42-- From phoyer@actividentity.com Fri Dec 18 05:57:42 2009 Return-Path: X-Original-To: keyprov@core3.amsl.com Delivered-To: keyprov@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 369413A67FC for ; Fri, 18 Dec 2009 05:57:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.245 X-Spam-Level: X-Spam-Status: No, score=-0.245 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_FR=0.35, HTML_MESSAGE=0.001, TRACKER_ID=2.003] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3zXvkqIPh9-B for ; Fri, 18 Dec 2009 05:57:41 -0800 (PST) Received: from frhub1.activcard.fr (frhub1.activcard.fr [91.151.120.133]) by core3.amsl.com (Postfix) with ESMTP id 57C9B3A67BD for ; Fri, 18 Dec 2009 05:57:40 -0800 (PST) Received: from sur-corp-ex-02.corp.ad.activcard.com (sur-corp-ex-02.corp.ad.activcard.com [192.168.33.40]) by frhub1.activcard.fr (Postfix) with ESMTP id CB86318396F; Fri, 18 Dec 2009 14:57:24 +0100 (CET) X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01CA7FEA.3B05F081" Date: Fri, 18 Dec 2009 14:58:52 +0100 Message-ID: <5BFE9E473DBFC24CA87F18F29B3F0AC40689027A@sur-corp-ex-02.corp.ad.activcard.com> In-Reply-To: <3E5A2F1AD44F5E49A74F79AB47C0C0C9015D0E74@mou1wnexmb10.vcorp.ad.vrsn.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: MAC cipher value mismatch (RE: New version of PSKC) Thread-Index: AcooAHlzUFYGcolgTzSpURpFcJPFOQDjyHAAFP8r8XAAF2478A== References: <5BFE9E473DBFC24CA87F18F29B3F0AC403EB7A6B@sur-corp-ex-02.corp.ad.activcard.com> <065171DAC4F2674EA8C1142A1AF8E7C31546AE7B@mou1wnexmb10.vcorp.ad.vrsn.com> <3E5A2F1AD44F5E49A74F79AB47C0C0C9015D0E74@mou1wnexmb10.vcorp.ad.vrsn.com> From: "Philip Hoyer" To: "Pei, Mingliang" , , "Phillip Hallam-Baker" Cc: "Doherty, Andrea" , =?iso-8859-1?Q?Magnus_Nystr=F6m?= , Salah Machani , KEYPROV , Dan Smith Subject: Re: [KEYPROV] MAC cipher value mismatch (RE: New version of PSKC) X-BeenThere: keyprov@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Provisioning of Symmetric Keys \(keyprov\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Dec 2009 13:57:42 -0000 This is a multi-part message in MIME format. ------_=_NextPart_001_01CA7FEA.3B05F081 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Ming, There is no other planned version, Hannes should be taking this to RFC = as we speak. =20 Hannes since there are 2 mistakes I the examples should we correct them? = And resubmit? Or what is the process at the moment. =20 Philip =20 ________________________________ From: Pei, Mingliang [mailto:mpei@verisign.com]=20 Sent: Friday, December 18, 2009 2:56 AM To: Philip Hoyer; Hannes.Tschofenig@gmx.net; Phillip Hallam-Baker; Salah = Machani; Sean Turner Cc: Doherty, Andrea; Magnus Nystr=F6m; KEYPROV; Dan Smith Subject: MAC cipher value mismatch (RE: New version of PSKC) =20 Hi Philip, =20 Dan pointed out the error in the example of spec v04, and I tried to = figure out where it was missed. I did provide the correct value as seen = in this email from 9/1. It looks that the last version didn't pick up = this change as needed. I assume that there will be another update before = the final RFC publish. Let us include this change in the final version. =20 Thanks, =20 - Ming =20 =09 ________________________________ From: Pei, Mingliang=20 Sent: Tuesday, September 01, 2009 10:44 PM To: Philip Hoyer; Hannes.Tschofenig@gmx.net; Phillip Hallam-Baker; = Salah Machani; Sean Turner Cc: Doherty, Andrea; Magnus Nystr=F6m; KEYPROV Subject: RE: New version of PSKC Hi Philip, =20 Please see the forwarded email that includes the examples from my = implementation that I sent earlier. The latest draft doesn't seem to = have the CipherValue for the MAC key right. Please update it to =20 2GTTnLwM3I4e5IO5FkufoOEiOhNj91fhKRQBtBJYluUDsPOLTfUvoU2dStyOwYZx =20 Thanks, =20 - Ming =20 =09 ________________________________ From: Philip Hoyer [mailto:phoyer@actividentity.com]=20 Sent: Friday, August 28, 2009 9:56 AM To: Hannes.Tschofenig@gmx.net; Phillip Hallam-Baker; Pei, Mingliang; = Salah Machani; Sean Turner Cc: Doherty, Andrea; Magnus Nystr=F6m; KEYPROV Subject: New version of PSKC Ladies and Gentlemen, Please find attached the new version of PSKC. =20 Changes: =20 * incorporated all of the feedback from Andrea and Sean.=20 * reference name change to the new DerivedKey element (moved to = XMLEnc11)=20 * Corrected AES example to include (prepend) IV inline with XMLENC = spec and mentions IV handling.=20 =20 I have one big problem: =20 The samples that Ming sent out for PBE and RSA do not match the ones = in the spec. =20 Especially the PBE is different form the one Ming already says was = corrected. =20 Based on the new XML Enc 1.1 spec for PBE and DerivedKeys. Are we sure = we are aligned here? =20 This is the only thing that needs to be clarified. =20 Otherwise, What do I need to do now. =20 Do I just submit or send to Russ and Pasi directly? =20 Philip =20 =20 ________________________________ =20 Philip Hoyer=20 =20 Senior Architect - Office of CTO =20 ActivIdentity (UK) 117 Waterloo Road London SE1 8UL =20 Telephone: +44 (0) 20 7960 0220 Fax: +44 (0) 20 7902 1985 =20 Private and confidential: This message and any attachments may contain privileged / confidential information. If you are not an intended = recipient, you must not copy, distribute, discuss or take any action in reliance = on it. If you have received this communication in error, please notify the = sender and delete this message immediately. =20 ------_=_NextPart_001_01CA7FEA.3B05F081 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Ming,

There is no other planned version, = Hannes should be taking this to RFC as we speak.

 

Hannes since there are 2 mistakes I = the examples should we correct them? And resubmit? Or what is the process at = the moment.

 

Philip

 

From: Pei, = Mingliang [mailto:mpei@verisign.com]
Sent: Friday, December = 18, 2009 2:56 AM
To: Philip Hoyer; Hannes.Tschofenig@gmx.net; Phillip Hallam-Baker; Salah Machani; Sean = Turner
Cc: Doherty, Andrea; = Magnus Nystr=F6m; KEYPROV; Dan Smith
Subject: MAC cipher value = mismatch (RE: New version of PSKC)

 

Hi = Philip,

 

Dan pointed out the error in the = example of spec v04, and I tried to figure out where it was missed. I = did provide the correct value as seen in this email from 9/1. It looks that = the last version didn't pick up this change as needed. I assume that there = will be another update before the final RFC publish. Let us include this change = in the final version.

 

Thanks,

=

 

- Ming

 

From: Pei, Mingliang
Sent: Tuesday, September = 01, 2009 10:44 PM
To: Philip Hoyer; Hannes.Tschofenig@gmx.net; Phillip Hallam-Baker; Salah Machani; Sean = Turner
Cc: Doherty, Andrea; = Magnus Nystr=F6m; KEYPROV
Subject: RE: New version = of PSKC

Hi = Philip,

 

Please see the forwarded email that includes the examples from my implementation that I sent earlier. The = latest draft doesn't seem to have the CipherValue for the MAC key right. Please = update it to

 

2GTTnLwM3I4e5IO5FkufoOEiOhNj91fhKRQBtBJYluUDsPOLTfUvoU2dStyOwYZx<= o:p>

 

Thanks,

=

 

- Ming

 

From: Philip Hoyer [mailto:phoyer@actividentity.com]
Sent: Friday, August 28, = 2009 9:56 AM
To: = Hannes.Tschofenig@gmx.net; Phillip Hallam-Baker; Pei, Mingliang; Salah Machani; Sean Turner
Cc: Doherty, Andrea; = Magnus Nystr=F6m; KEYPROV
Subject: New version of = PSKC

Ladies and = Gentlemen,

Please find attached the new version of = PSKC.

 

Changes:

 

  • incorporated all of the feedback from Andrea and Sean. =
  • reference = name change to the new DerivedKey element (moved to = XMLEnc11)
  • Corrected = AES example to include (prepend) IV inline with XMLENC spec and = mentions IV handling.

 

I have one big = problem:

 

The samples that Ming sent out for PBE and RSA = do not match the ones in the spec.

 

Especially the PBE is different form the one = Ming already says was corrected.

 

Based on the new XML Enc 1.1 spec for PBE and DerivedKeys. Are we sure we are aligned = here?

 

This is the only thing that needs to be = clarified.

 

Otherwise,

What do I need to do = now.

 

Do I just submit or send to Russ and Pasi = directly?

 

Philip

 

 

________________________________

 

Philip Hoyer =

 

Senior Architect - = Office of CTO

 

ActivIdentity = (UK)=

117 Waterloo Road

London SE1 8UL

 

Telephone: +44 (0) = 20 7960 0220

Fax: +44 (0) 20 = 7902 1985

 

Private and = confidential: This message and any attachments may = contain

privileged / = confidential information. If you are not an intended = recipient,

you must not copy, distribute, discuss or take any action in reliance on = it.

If you have = received this communication in error, please notify the = sender

and delete this = message immediately.

 

------_=_NextPart_001_01CA7FEA.3B05F081--