From mpei@verisign.com Tue Jan 4 12:51:23 2011 Return-Path: X-Original-To: keyprov@core3.amsl.com Delivered-To: keyprov@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E71903A6A17 for ; Tue, 4 Jan 2011 12:51:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id naXJNFGzJUWH for ; Tue, 4 Jan 2011 12:51:22 -0800 (PST) Received: from robin.verisign.com (robin.verisign.com [65.205.251.75]) by core3.amsl.com (Postfix) with ESMTP id 7C7FD3A69A9 for ; Tue, 4 Jan 2011 12:51:22 -0800 (PST) Received: from MOU1WNEXCN02.vcorp.ad.vrsn.com (mailer2.verisign.com [65.205.251.35]) by robin.verisign.com (8.12.11/8.13.4) with ESMTP id p04KrTbu016366; Tue, 4 Jan 2011 12:53:29 -0800 Received: from MOU1WNEXMB10.vcorp.ad.vrsn.com ([10.25.13.204]) by MOU1WNEXCN02.vcorp.ad.vrsn.com with Microsoft SMTPSVC(6.0.3790.4675); Tue, 4 Jan 2011 12:53:28 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Tue, 4 Jan 2011 12:53:27 -0800 Message-ID: <3E5A2F1AD44F5E49A74F79AB47C0C0C901E04EAD@mou1wnexmb10.vcorp.ad.vrsn.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: New Version Notification for draft-mraihi-totp-timebased-07 Thread-Index: AcusUTVGRiW1E21UQreSkSbTcVGkFAAABe4A From: "Pei, Mingliang" To: , X-OriginalArrivalTime: 04 Jan 2011 20:53:28.0930 (UTC) FILETIME=[7075FC20:01CBAC51] Subject: [KEYPROV] FW: New Version Notification for draft-mraihi-totp-timebased-07 X-BeenThere: keyprov@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Provisioning of Symmetric Keys \(keyprov\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Jan 2011 20:51:24 -0000 FYI. The version updated reference implementation code with a fix on Hmac256 / Hmac512 seed data. - Ming -----Original Message----- From: IETF I-D Submission Tool [mailto:idsubmission@ietf.org]=20 Sent: Tuesday, January 04, 2011 12:50 PM To: Mingliang_Pei@symantec.com Cc: davidietf@gmail.com; smachani@diversinet.com; johan.rydell@portwise.com Subject: New Version Notification for draft-mraihi-totp-timebased-07=20 A new version of I-D, draft-mraihi-totp-timebased-07.txt has been successfully submitted by Mingliang Pei and posted to the IETF repository. Filename: draft-mraihi-totp-timebased Revision: 07 Title: TOTP: Time-based One-time Password Algorithm Creation_date: 2011-01-04 WG ID: Independent Submission Number_of_pages: 16 Abstract: This document describes an extension of one-time password (OTP) algorithm, namely the HAMC-Based One-Time Password (HOTP) Algorithm as defined in RFC 4226, to support time-based moving factor. The HOTP algorithm specifies an event based OTP algorithm where the moving factor is an event counter. The present work bases the moving factor on a time value. A time-based variant of the OTP algorithm provides short-lived OTP values, which are desirable for enhanced security. The proposed algorithm can be used across a wide range of network applications ranging from remote Virtual Private Network (VPN) access, Wi-Fi network logon to transaction-oriented Web applications. The authors believe that a common and shared algorithm will facilitate adoption of two-factor authentication on the Internet by enabling interoperability across commercial and open-source implementations. =20 The IETF Secretariat. From hannes.tschofenig@gmx.net Wed Jan 19 02:30:12 2011 Return-Path: X-Original-To: keyprov@core3.amsl.com Delivered-To: keyprov@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8242A3A70DD for ; Wed, 19 Jan 2011 02:30:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.553 X-Spam-Level: X-Spam-Status: No, score=-102.553 tagged_above=-999 required=5 tests=[AWL=0.046, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RSBwbT0eLFEK for ; Wed, 19 Jan 2011 02:30:11 -0800 (PST) Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.23]) by core3.amsl.com (Postfix) with SMTP id 4C61D3A6E47 for ; Wed, 19 Jan 2011 02:30:10 -0800 (PST) Received: (qmail invoked by alias); 19 Jan 2011 10:32:49 -0000 Received: from unknown (EHLO [10.255.139.127]) [192.100.123.77] by mail.gmx.net (mp059) with SMTP; 19 Jan 2011 11:32:49 +0100 X-Authenticated: #29516787 X-Provags-ID: V01U2FsdGVkX18qBadspNgqoa3Jdwj3kgT+fYnAuolNG61WZM32XX AG55y1K5eLb3bI From: Hannes Tschofenig Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Date: Wed, 19 Jan 2011 12:32:46 +0200 Message-Id: <3E2A0ABE-05DA-4641-A8A8-BDE967A1D2D9@gmx.net> To: KEYPROV Mime-Version: 1.0 (Apple Message framework v1082) X-Mailer: Apple Mail (2.1082) X-Y-GMX-Trusted: 0 Cc: Hannes Tschofenig Subject: [KEYPROV] CMS Usage in a Browser Environment X-BeenThere: keyprov@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Provisioning of Symmetric Keys \(keyprov\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jan 2011 10:30:12 -0000 Hi all,=20 I am wondering whether someone has gotten some experience with CMS usage = in a browser based environment for signing JSON tokens (or other = content).=20 Ciao Hannes PS: I am working with others on a BOF about JSON cryptographic = procedures: http://trac.tools.ietf.org/bof/trac/wiki/WikiStart From anders.rundgren@telia.com Wed Jan 19 03:47:04 2011 Return-Path: X-Original-To: keyprov@core3.amsl.com Delivered-To: keyprov@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C7B9B3A6FC4 for ; Wed, 19 Jan 2011 03:47:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.129 X-Spam-Level: X-Spam-Status: No, score=-3.129 tagged_above=-999 required=5 tests=[AWL=0.470, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g0XeP1ZLqZBU for ; Wed, 19 Jan 2011 03:47:03 -0800 (PST) Received: from smtp-out21.han.skanova.net (smtp-out21.han.skanova.net [195.67.226.208]) by core3.amsl.com (Postfix) with ESMTP id 4B9973A6FC1 for ; Wed, 19 Jan 2011 03:47:03 -0800 (PST) Received: from [192.168.0.201] (81.232.45.215) by smtp-out21.han.skanova.net (8.5.133) (authenticated as u36408181) id 4D07517100B5F3B8; Wed, 19 Jan 2011 12:49:40 +0100 Message-ID: <4D36CFD3.8030403@telia.com> Date: Wed, 19 Jan 2011 12:49:39 +0100 From: Anders Rundgren User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: Hannes Tschofenig References: <3E2A0ABE-05DA-4641-A8A8-BDE967A1D2D9@gmx.net> In-Reply-To: <3E2A0ABE-05DA-4641-A8A8-BDE967A1D2D9@gmx.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: KEYPROV Subject: Re: [KEYPROV] CMS Usage in a Browser Environment X-BeenThere: keyprov@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Provisioning of Symmetric Keys \(keyprov\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jan 2011 11:47:04 -0000 Hannes Tschofenig wrote: > Hi all, > > I am wondering whether someone has gotten some experience with CMS usage in a browser based environment for signing JSON tokens (or other content). Hi Hannes, I believe almost every browser is running on a cryptographic platform that supports CMS. However, they don't expose this functionality because that would be a security problem unless there is a GUI involved where the user grants the browser to sign an object including saying which key to use. This is essentially what I've been ranting about since years back: you don't get anywhere unless you start programming browsers or know somebody who do. What the GUI should contain is depending on the underlaying application. In WASP (http://webpki.org/papers/wasp/wasp-tutorial.pdf) it is about signing a document (request), while in KeyGen2 (http://webpki.org/auth-token-4-the-cloud.html) it is about allowing an issuer creating keys. I have FWIW downloaded Firefox 4 beta code and have managed to compile it at least. Since this isn't my day-job I guess the rest will be slow. If there is somebody out there who is interested in making browsers more capable, just drop me a line :-) Cheers, Anders > > Ciao > Hannes > > PS: I am working with others on a BOF about JSON cryptographic procedures: > http://trac.tools.ietf.org/bof/trac/wiki/WikiStart > > _______________________________________________ > KEYPROV mailing list > KEYPROV@ietf.org > https://www.ietf.org/mailman/listinfo/keyprov > From hannes.tschofenig@gmx.net Wed Jan 19 04:07:00 2011 Return-Path: X-Original-To: keyprov@core3.amsl.com Delivered-To: keyprov@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 644673A6FB9 for ; Wed, 19 Jan 2011 04:07:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.554 X-Spam-Level: X-Spam-Status: No, score=-102.554 tagged_above=-999 required=5 tests=[AWL=0.045, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sDsRzeAi2h5i for ; Wed, 19 Jan 2011 04:06:59 -0800 (PST) Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id 8C11D3A6FB4 for ; Wed, 19 Jan 2011 04:06:52 -0800 (PST) Received: (qmail invoked by alias); 19 Jan 2011 12:09:31 -0000 Received: from unknown (EHLO [10.255.139.127]) [192.100.123.77] by mail.gmx.net (mp036) with SMTP; 19 Jan 2011 13:09:31 +0100 X-Authenticated: #29516787 X-Provags-ID: V01U2FsdGVkX1/hBoxz1rbhwlwzD5ZpSy/nvG9kUG5tJYcTOLQ8ip brAgEXv++3jdHw Mime-Version: 1.0 (Apple Message framework v1082) Content-Type: text/plain; charset=us-ascii From: Hannes Tschofenig In-Reply-To: <4D36CFD3.8030403@telia.com> Date: Wed, 19 Jan 2011 14:09:28 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: <92785801-D43A-4BD9-B933-EDD32A1A39A0@gmx.net> References: <3E2A0ABE-05DA-4641-A8A8-BDE967A1D2D9@gmx.net> <4D36CFD3.8030403@telia.com> To: Anders Rundgren X-Mailer: Apple Mail (2.1082) X-Y-GMX-Trusted: 0 Cc: Hannes Tschofenig , KEYPROV Subject: Re: [KEYPROV] CMS Usage in a Browser Environment X-BeenThere: keyprov@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Provisioning of Symmetric Keys \(keyprov\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jan 2011 12:07:00 -0000 Hi Anders,=20 yes, I vaguely recall that discussion. The issue you raise does not = necessarily relate to the cryptographic functionality of CMS but rather = the ability to access a key store from JavaScript. This would be largely = independent of the actual approach for signing. Right? While your point is indeed valid the question I have is more along the = lines of implementing the cryptographic mechanisms in JavaScript in the = browser and whether someone had tried to implement CMS there. Ciao Hannes On Jan 19, 2011, at 1:49 PM, Anders Rundgren wrote: > Hannes Tschofenig wrote: >> Hi all, I am wondering whether someone has gotten some experience = with CMS usage in > a browser based environment for signing JSON tokens (or other = content). >=20 > Hi Hannes, >=20 > I believe almost every browser is running on a cryptographic platform = that > supports CMS. However, they don't expose this functionality because = that > would be a security problem unless there is a GUI involved where the = user > grants the browser to sign an object including saying which key to = use. >=20 > This is essentially what I've been ranting about since years back: > you don't get anywhere unless you start programming browsers or know > somebody who do. >=20 > What the GUI should contain is depending on the underlaying = application. > In WASP (http://webpki.org/papers/wasp/wasp-tutorial.pdf) it is about > signing a document (request), while in KeyGen2 = (http://webpki.org/auth-token-4-the-cloud.html) > it is about allowing an issuer creating keys. >=20 > I have FWIW downloaded Firefox 4 beta code and have managed to compile > it at least. Since this isn't my day-job I guess the rest will be = slow. > If there is somebody out there who is interested in making browsers = more > capable, just drop me a line :-) >=20 > Cheers, > Anders >=20 >> Ciao >> Hannes >> PS: I am working with others on a BOF about JSON cryptographic = procedures: >> http://trac.tools.ietf.org/bof/trac/wiki/WikiStart >> _______________________________________________ >> KEYPROV mailing list >> KEYPROV@ietf.org >> https://www.ietf.org/mailman/listinfo/keyprov >=20 >=20 > _______________________________________________ > KEYPROV mailing list > KEYPROV@ietf.org > https://www.ietf.org/mailman/listinfo/keyprov From anders.rundgren@telia.com Wed Jan 19 04:22:53 2011 Return-Path: X-Original-To: keyprov@core3.amsl.com Delivered-To: keyprov@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 95C253A710F for ; Wed, 19 Jan 2011 04:22:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.155 X-Spam-Level: X-Spam-Status: No, score=-3.155 tagged_above=-999 required=5 tests=[AWL=0.444, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IhuFeL8tUREb for ; Wed, 19 Jan 2011 04:22:52 -0800 (PST) Received: from smtp-out21.han.skanova.net (smtp-out21.han.skanova.net [195.67.226.208]) by core3.amsl.com (Postfix) with ESMTP id DFC2428C0EA for ; Wed, 19 Jan 2011 04:22:51 -0800 (PST) Received: from [192.168.0.201] (81.232.45.215) by smtp-out21.han.skanova.net (8.5.133) (authenticated as u36408181) id 4D07517100B63BD8; Wed, 19 Jan 2011 13:25:29 +0100 Message-ID: <4D36D838.1070500@telia.com> Date: Wed, 19 Jan 2011 13:25:28 +0100 From: Anders Rundgren User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: Hannes Tschofenig References: <3E2A0ABE-05DA-4641-A8A8-BDE967A1D2D9@gmx.net> <4D36CFD3.8030403@telia.com> <92785801-D43A-4BD9-B933-EDD32A1A39A0@gmx.net> In-Reply-To: <92785801-D43A-4BD9-B933-EDD32A1A39A0@gmx.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: KEYPROV Subject: Re: [KEYPROV] CMS Usage in a Browser Environment X-BeenThere: keyprov@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Provisioning of Symmetric Keys \(keyprov\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jan 2011 12:22:53 -0000 Hannes Tschofenig wrote: > Hi Anders, > > yes, I vaguely recall that discussion. The issue you raise does not > necessarily relate to the cryptographic functionality of CMS but rather > the ability to access a key store from JavaScript. This would be largely > independent of the actual approach for signing. Right? > > While your point is indeed valid the question I have is more along the > lines of implementing the cryptographic mechanisms in JavaScript in > the browser and whether someone had tried to implement CMS there. I see. This is as you say an entirely different issue. People have been doing RSA signatures for a decade in browsers so CMS shouldn't be problem although I haven't any code for that. Since native key store access is a no-no, I guess you are talking about cookies and/or web-db as key stores? Cheers, Anders > > Ciao > Hannes > > On Jan 19, 2011, at 1:49 PM, Anders Rundgren wrote: > >> Hannes Tschofenig wrote: >>> Hi all, I am wondering whether someone has gotten some experience with CMS usage in >> a browser based environment for signing JSON tokens (or other content). >> >> Hi Hannes, >> >> I believe almost every browser is running on a cryptographic platform that >> supports CMS. However, they don't expose this functionality because that >> would be a security problem unless there is a GUI involved where the user >> grants the browser to sign an object including saying which key to use. >> >> This is essentially what I've been ranting about since years back: >> you don't get anywhere unless you start programming browsers or know >> somebody who do. >> >> What the GUI should contain is depending on the underlaying application. >> In WASP (http://webpki.org/papers/wasp/wasp-tutorial.pdf) it is about >> signing a document (request), while in KeyGen2 (http://webpki.org/auth-token-4-the-cloud.html) >> it is about allowing an issuer creating keys. >> >> I have FWIW downloaded Firefox 4 beta code and have managed to compile >> it at least. Since this isn't my day-job I guess the rest will be slow. >> If there is somebody out there who is interested in making browsers more >> capable, just drop me a line :-) >> >> Cheers, >> Anders >> >>> Ciao >>> Hannes >>> PS: I am working with others on a BOF about JSON cryptographic procedures: >>> http://trac.tools.ietf.org/bof/trac/wiki/WikiStart >>> _______________________________________________ >>> KEYPROV mailing list >>> KEYPROV@ietf.org >>> https://www.ietf.org/mailman/listinfo/keyprov >> >> _______________________________________________ >> KEYPROV mailing list >> KEYPROV@ietf.org >> https://www.ietf.org/mailman/listinfo/keyprov > > From wwwrun@rfc-editor.org Mon Jan 31 04:19:58 2011 Return-Path: X-Original-To: keyprov@core3.amsl.com Delivered-To: keyprov@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9135B3A6BEC for ; Mon, 31 Jan 2011 04:19:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.712 X-Spam-Level: X-Spam-Status: No, score=-101.712 tagged_above=-999 required=5 tests=[AWL=-0.312, BAYES_00=-2.599, J_CHICKENPOX_81=0.6, J_CHICKENPOX_82=0.6, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l50ue-5OMsps for ; Mon, 31 Jan 2011 04:19:57 -0800 (PST) Received: from rfc-editor.org (rfc-editor.org [IPv6:2001:1890:1112:1::2f]) by core3.amsl.com (Postfix) with ESMTP id E604C3A6938 for ; Mon, 31 Jan 2011 04:19:57 -0800 (PST) Received: by rfc-editor.org (Postfix, from userid 30) id 65FF6E0724; Mon, 31 Jan 2011 04:23:12 -0800 (PST) To: andrea.doherty@rsa.com, mpei@verisign.com, smachani@diversinet.com, mnystrom@microsoft.com, turners@ieca.com, tim.polk@nist.gov, phill@hallambaker.com, Hannes.Tschofenig@gmx.net From: RFC Errata System Message-Id: <20110131122312.65FF6E0724@rfc-editor.org> Date: Mon, 31 Jan 2011 04:23:12 -0800 (PST) Cc: nmalykh@protocols.ru, keyprov@ietf.org, rfc-editor@rfc-editor.org Subject: [KEYPROV] [Editorial Errata Reported] RFC6063 (2697) X-BeenThere: keyprov@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Provisioning of Symmetric Keys \(keyprov\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Jan 2011 12:19:58 -0000 The following errata report has been submitted for RFC6063, "Dynamic Symmetric Key Provisioning Protocol (DSKPP)". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=6063&eid=2697 -------------------------------------- Type: Editorial Reported by: Nikolai Malykh Section: 3.4.1.1 Original Text ------------- Assume that the raw Client ID value or the value entered by the use is: myclient!ID Corrected Text -------------- Assume that the raw Client ID value or the value entered by the use is: myclient!D Notes ----- Erroneously entered an extra character "I" into Client ID value. Instructions: ------------- This errata is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party (IESG) can log in to change the status and edit the report, if necessary. -------------------------------------- RFC6063 (draft-ietf-keyprov-dskpp-14) -------------------------------------- Title : Dynamic Symmetric Key Provisioning Protocol (DSKPP) Publication Date : December 2010 Author(s) : A. Doherty, M. Pei, S. Machani, M. Nystrom Category : PROPOSED STANDARD Source : Provisioning of Symmetric Keys Area : Security Stream : IETF Verifying Party : IESG