Re: [KEYPROV] FW: New Version Notification - draft-ietf-keyprov-dskpp-12.txt

All,

At this stage, I propose that we have two options for addressing Ander's
comment below:

1. Remove Section A.7

2. Defer addressing this for the next version of DSKPP

Thoughts?

Andrea

-----Original Message-----
From: Anders Rundgren [mailto:anders.rundgren@telia.com] 
Sent: Monday, August 30, 2010 3:04 AM
To: Doherty, Andrea
Cc: keyprov@ietf.org
Subject: Re: [KEYPROV] FW: New Version Notification -
draft-ietf-keyprov-dskpp-12.txt

A.7
    "Application Protocol Data
     Units, or APDUs) are encrypted with a pre-issued card
manufacturer's
     key and sent directly to the smart card chip, allowing secure post-
     issuance in-the-field provisioning"

Andrea, this is *still* inappropriate for the DSKPP I-D because the only
E2ES schemes I have heard about (GP/ETSI SCPxx and SKS/KG2) are fairly
different to DSKPP since they build on having a *session* with the
container, and using "rolling MACs" for maintaining integrity in a
multi-stage provisioning/update operation.

To achieve E2ES the container and protocol *must* be 1-2-1 on "APDU"
level.  PKCS #11, CryptoAPI, and JCE do not support E2ES provisioning
so this feature is really quite distinct to just having a known key in
the container which any crypto-APIs can support.

I.e. E2ES is not an DSKPP "implementation option", it is a description
of
how *other* (more or less competing) schemes have addressed
provisioning.

Microsoft supports E2ES in their ILM (Identity Lifecycle Manager) since
2007 so it is not just a(nother) crazy idea by your former college :-)

The RSA division probably needs to begin dealing with E2ES in order to
keep up with the rest of the token-provisioning world.

If you take the step to 32-bit processors you may even be able to add
transaction-based operation which is the next logical step after E2ES.

/Anders

Doherty, et al.           Expires March 2, 2011                [Page 76]

Internet-Draft                    DSKPP                      August 2010

    issuance in-the-field provisioning.

andrea.doherty@rsa.com wrote:
>  
> -----Original Message-----
> From: Internet-Draft@ietf.org [mailto:Internet-Draft@ietf.org] 
> Sent: Sunday, August 29, 2010 11:15 PM
> To: keyprov-chairs@tools.ietf.org;
draft-ietf-keyprov-dskpp@tools.ietf.org; tim.polk@nist.gov;
alexey.melnikov@isode.com; stpeter@stpeter.im
> Subject: New Version Notification - draft-ietf-keyprov-dskpp-12.txt 
> 
> New version (-12) has been submitted for
draft-ietf-keyprov-dskpp-12.txt.
> http://www.ietf.org/internet-drafts/draft-ietf-keyprov-dskpp-12.txt
> 
> 
> Diff from previous version:
> http://tools.ietf.org/rfcdiff?url2=draft-ietf-keyprov-dskpp-12
> 
> IETF Secretariat.
> 
> _______________________________________________
> KEYPROV mailing list
> KEYPROV@ietf.org
> https://www.ietf.org/mailman/listinfo/keyprov
> 