From wwwrun@rfc-editor.org  Wed Oct  3 00:52:00 2012
Return-Path: <wwwrun@rfc-editor.org>
X-Original-To: keyprov@ietfa.amsl.com
Delivered-To: keyprov@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3517F21F84A2 for <keyprov@ietfa.amsl.com>; Wed,  3 Oct 2012 00:52:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.304
X-Spam-Level: 
X-Spam-Status: No, score=-102.304 tagged_above=-999 required=5 tests=[AWL=0.296, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K7nMSnV9wh81 for <keyprov@ietfa.amsl.com>; Wed,  3 Oct 2012 00:51:59 -0700 (PDT)
Received: from rfc-editor.org (rfc-editor.org [IPv6:2001:1890:123a::1:2f]) by ietfa.amsl.com (Postfix) with ESMTP id 47DAD21F849B for <keyprov@ietf.org>; Wed,  3 Oct 2012 00:51:53 -0700 (PDT)
Received: by rfc-editor.org (Postfix, from userid 30) id A303DB1E003; Wed,  3 Oct 2012 00:47:27 -0700 (PDT)
To: phoyer@actividentity.com, mpei@verisign.com, smachani@diversinet.com, stephen.farrell@cs.tcd.ie, turners@ieca.com, phill@hallambaker.com, Hannes.Tschofenig@gmx.net
From: RFC Errata System <rfc-editor@rfc-editor.org>
Message-Id: <20121003074727.A303DB1E003@rfc-editor.org>
Date: Wed,  3 Oct 2012 00:47:27 -0700 (PDT)
Cc: keyprov@ietf.org, rfc-editor@rfc-editor.org
Subject: [KEYPROV] [Technical Errata Reported] RFC6030 (3369)
X-BeenThere: keyprov@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Provisioning of Symmetric Keys \(keyprov\)" <keyprov.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/keyprov>, <mailto:keyprov-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/keyprov>
List-Post: <mailto:keyprov@ietf.org>
List-Help: <mailto:keyprov-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/keyprov>, <mailto:keyprov-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 03 Oct 2012 07:52:00 -0000

The following errata report has been submitted for RFC6030,
"Portable Symmetric Key Container (PSKC)".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6030&eid=3369

--------------------------------------
Type: Technical
Reported by: Simon Josefsson <simon@josefsson.org>

Section: 4.3.1

Original Text
-------------
   <Manufacturer>:  This element indicates the manufacturer of the
      device.  Values for the <Manufacturer> element MUST be taken from
      either [OATHMAN] prefixes (i.e., the left column) or from the IANA
      Private Enterprise Number Registry [IANAPENREG], using the
      Organization value.  When the value is taken from [OATHMAN],
      "oath."  MUST be prepended to the value (e.g., "oath.<prefix value
      from [OATHMAN]>").  When the value is taken from [IANAPENREG],
      "iana."  MUST be prepended to the value (e.g., "iana.<Organization
      value from [IANAPENREG]>").


Corrected Text
--------------
   <Manufacturer>:  This element indicates the manufacturer of the
      device.  Values for the <Manufacturer> element MAY be taken from
      either [OATHMAN] prefixes (i.e., the left column) or from the IANA
      Private Enterprise Number Registry [IANAPENREG], using the
      Organization value.  When the value is taken from [OATHMAN],
      "oath."  MUST be prepended to the value (e.g., "oath.<prefix value
      from [OATHMAN]>").  When the value is taken from [IANAPENREG],
      "iana."  MUST be prepended to the value (e.g., "iana.<Organization
      value from [IANAPENREG]>").


Notes
-----
The only thing changed is relaxing MUST to MAY.

The requirement that manufacturer strings begin with "oath." and "iana." is often ignored by implementations/deployments.  Further, none of the examples throughout the document conform to the syntax.  While we could regard these as implementation/deployment and editorial document bugs, I would argue that we could just as well relax the technical requirement because there appears to be no harm in allowing free-form text.  This is what people appear to be using out there already.

Examples of non-conforming <Manufacturer> fields out there:
http://tools.ietf.org/html/draft-hoyer-keyprov-pskc-algorithm-profiles-01
http://download.gooze.eu/otp/seeds/20120919-test001-4282.xml

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6030 (draft-ietf-keyprov-pskc-09)
--------------------------------------
Title               : Portable Symmetric Key Container (PSKC)
Publication Date    : October 2010
Author(s)           : P. Hoyer, M. Pei, S. Machani
Category            : PROPOSED STANDARD
Source              : Provisioning of Symmetric Keys
Area                : Security
Stream              : IETF
Verifying Party     : IESG

From wwwrun@rfc-editor.org  Wed Oct  3 13:09:21 2012
Return-Path: <wwwrun@rfc-editor.org>
X-Original-To: keyprov@ietfa.amsl.com
Delivered-To: keyprov@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2644621F84F0 for <keyprov@ietfa.amsl.com>; Wed,  3 Oct 2012 13:09:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.307
X-Spam-Level: 
X-Spam-Status: No, score=-102.307 tagged_above=-999 required=5 tests=[AWL=0.293, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cj0gUbHx-I-b for <keyprov@ietfa.amsl.com>; Wed,  3 Oct 2012 13:09:20 -0700 (PDT)
Received: from rfc-editor.org (rfc-editor.org [IPv6:2001:1890:123a::1:2f]) by ietfa.amsl.com (Postfix) with ESMTP id C2A0321F84EE for <keyprov@ietf.org>; Wed,  3 Oct 2012 13:09:20 -0700 (PDT)
Received: by rfc-editor.org (Postfix, from userid 30) id B0CFA72F1D4; Wed,  3 Oct 2012 13:04:53 -0700 (PDT)
To: phoyer@actividentity.com, mpei@verisign.com, smachani@diversinet.com, stephen.farrell@cs.tcd.ie, turners@ieca.com, phill@hallambaker.com, Hannes.Tschofenig@gmx.net
From: RFC Errata System <rfc-editor@rfc-editor.org>
Message-Id: <20121003200453.B0CFA72F1D4@rfc-editor.org>
Date: Wed,  3 Oct 2012 13:04:53 -0700 (PDT)
Cc: keyprov@ietf.org, rfc-editor@rfc-editor.org
Subject: [KEYPROV] [Editorial Errata Reported] RFC6030 (3370)
X-BeenThere: keyprov@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Provisioning of Symmetric Keys \(keyprov\)" <keyprov.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/keyprov>, <mailto:keyprov-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/keyprov>
List-Post: <mailto:keyprov@ietf.org>
List-Help: <mailto:keyprov-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/keyprov>, <mailto:keyprov-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 03 Oct 2012 20:09:21 -0000

The following errata report has been submitted for RFC6030,
"Portable Symmetric Key Container (PSKC)".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6030&eid=3370

--------------------------------------
Type: Editorial
Reported by: Simon Josefsson <simon@josefsson.org>

Section: 6.3

Original Text
-------------
       id="KC0001"


Corrected Text
--------------
       Id="KC0001"


Notes
-----
The PSKC data in figure 8 does not pass a XML Schema validation -- the reason is a typo in the Id attribute name.

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6030 (draft-ietf-keyprov-pskc-09)
--------------------------------------
Title               : Portable Symmetric Key Container (PSKC)
Publication Date    : October 2010
Author(s)           : P. Hoyer, M. Pei, S. Machani
Category            : PROPOSED STANDARD
Source              : Provisioning of Symmetric Keys
Area                : Security
Stream              : IETF
Verifying Party     : IESG

From simon@josefsson.org  Thu Oct 11 11:22:55 2012
Return-Path: <simon@josefsson.org>
X-Original-To: keyprov@ietfa.amsl.com
Delivered-To: keyprov@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB89A1F0381 for <keyprov@ietfa.amsl.com>; Thu, 11 Oct 2012 11:22:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -98.98
X-Spam-Level: 
X-Spam-Status: No, score=-98.98 tagged_above=-999 required=5 tests=[AWL=-0.929, BAYES_20=-0.74, FH_HOST_EQ_D_D_D_D=0.765, HELO_MISMATCH_COM=0.553, HOST_EQ_STATICB=1.372, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5sH1-R9jKmCI for <keyprov@ietfa.amsl.com>; Thu, 11 Oct 2012 11:22:54 -0700 (PDT)
Received: from yxa-v.extundo.com (static-213-115-179-173.sme.bredbandsbolaget.se [213.115.179.173]) by ietfa.amsl.com (Postfix) with ESMTP id DE49C1F0429 for <keyprov@ietf.org>; Thu, 11 Oct 2012 11:22:45 -0700 (PDT)
Received: from latte (host-95-193-1-90.mobileonline.telia.com [95.193.1.90]) (authenticated bits=0) by yxa-v.extundo.com (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id q9BIMbZM009014 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT) for <keyprov@ietf.org>; Thu, 11 Oct 2012 20:22:40 +0200
X-Hashcash: 1:22:121011:keyprov@ietf.org::jUjaivkxU0FvdeeZ:5hqu
From: Simon Josefsson <simon@josefsson.org>
To: keyprov@ietf.org
OpenPGP: id=B565716F; url=http://josefsson.org/key.txt
Date: Thu, 11 Oct 2012 20:22:29 +0200
Message-ID: <87mwzs3m3e.fsf@latte.josefsson.org>
User-Agent: Gnus/5.130006 (Ma Gnus v0.6) Emacs/24.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-Virus-Scanned: clamav-milter 0.97.3 at yxa-v
X-Virus-Status: Clean
Subject: [KEYPROV] Free software PSKC implementation
X-BeenThere: keyprov@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Provisioning of Symmetric Keys \(keyprov\)" <keyprov.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/keyprov>, <mailto:keyprov-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/keyprov>
List-Post: <mailto:keyprov@ietf.org>
List-Help: <mailto:keyprov-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/keyprov>, <mailto:keyprov-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 11 Oct 2012 18:22:55 -0000

Hi all,

I wanted to let you know that I have just released a (partial) PSKC
implementation as free software in OATH Toolkit:

http://www.nongnu.org/oath-toolkit/

The tutorial is a good introduction to the functionality:

http://www.nongnu.org/oath-toolkit/libpskc-api/pskc-tutorial-pskctool.html
http://www.nongnu.org/oath-toolkit/libpskc-api/pskc-tutorial-quickstart.html

If anyone is interested in interop testing, please talk to me offlist.

/Simon

From simon@josefsson.org  Tue Oct 16 01:07:31 2012
Return-Path: <simon@josefsson.org>
X-Original-To: keyprov@ietfa.amsl.com
Delivered-To: keyprov@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA24821F8862 for <keyprov@ietfa.amsl.com>; Tue, 16 Oct 2012 01:07:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -99.444
X-Spam-Level: 
X-Spam-Status: No, score=-99.444 tagged_above=-999 required=5 tests=[AWL=0.465, BAYES_00=-2.599, FH_HOST_EQ_D_D_D_D=0.765, HELO_MISMATCH_COM=0.553, HOST_EQ_STATICB=1.372, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1gtu2TJ2PokP for <keyprov@ietfa.amsl.com>; Tue, 16 Oct 2012 01:07:31 -0700 (PDT)
Received: from yxa-v.extundo.com (static-213-115-179-173.sme.bredbandsbolaget.se [213.115.179.173]) by ietfa.amsl.com (Postfix) with ESMTP id AAD3021F8832 for <keyprov@ietf.org>; Tue, 16 Oct 2012 01:07:29 -0700 (PDT)
Received: from latte (host-95-193-1-90.mobileonline.telia.com [95.193.1.90]) (authenticated bits=0) by yxa-v.extundo.com (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id q9G87Kxr029709 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT) for <keyprov@ietf.org>; Tue, 16 Oct 2012 10:07:22 +0200
X-Hashcash: 1:22:121016:keyprov@ietf.org::wNF4G97uLRH1uJ7+:VyH1
From: Simon Josefsson <simon@josefsson.org>
To: keyprov@ietf.org
OpenPGP: id=B565716F; url=http://josefsson.org/key.txt
Date: Tue, 16 Oct 2012 10:07:14 +0200
Message-ID: <87vceaq1ql.fsf@latte.josefsson.org>
User-Agent: Gnus/5.130006 (Ma Gnus v0.6) Emacs/24.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-Virus-Scanned: clamav-milter 0.97.3 at yxa-v
X-Virus-Status: Clean
Subject: [KEYPROV] Bug in PSKC XML schema wrt XMLDsig?
X-BeenThere: keyprov@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Provisioning of Symmetric Keys \(keyprov\)" <keyprov.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/keyprov>, <mailto:keyprov-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/keyprov>
List-Post: <mailto:keyprov@ietf.org>
List-Help: <mailto:keyprov-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/keyprov>, <mailto:keyprov-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 16 Oct 2012 08:07:31 -0000

All,

I have implemented support for XMLDsig protected PSKC and ran into an
issue with the XML Schema for PSKC.  It seems the Signature element is
in the wrong namespace, making it incompatible with the XMLDsig
specification.

There is a thread on this on the XMLSec mailing list:

http://thread.gmane.org/gmane.text.xml.xmlsec/4178

Both Aleksey Sanin (author of the XMLSec library) and G. Ken Holman (XML
expert) appear to believe this is an error in the schema:

http://thread.gmane.org/gmane.text.xml.xmlsec/4178/focus=4181
http://thread.gmane.org/gmane.text.xml.xmlsec/4178/focus=4185

The fix appears to be simple, but before filing an RFC errata for this
I'd thought I should bring this up in case anyone wants to comment.

Section 7:

OLD:
       <Signature>
NEW:
       <ds:Signature>

OLD:
       </Signature>
NEW:
       </ds:Signature>

Section 11:

OLD:
               <xs:element name="Signature"
                    type="ds:SignatureType" minOccurs="0"/>

NEW:
               <xs:element ref="ds:Signature" minOccurs="0">

/Simon