Re: [kitten] Comments on draft-ietf-kitten-krb-spake-preauth-00

[Greg Hudson <[e-mail]>]

On 08/14/2017 01:30 PM, Henry B (Hank) Hotz, CISSP wrote:
>>> [NIT] Section 4.3, para 2: Delete the word “Next”. On my first reading that led me to think it was describing what to do after “the client completes. . .”. It actually describes the *first* thing to do (in the third pass). I’ve now read it enough times that I’m no longer qualified to say how important that is.
>>
>> The word "Next" is intended, but I can see that "will complete its part
>> of the SPAKE process" is too vague--it is not clear that it is
>> describing a computation step with no protocol messages.  I propose this
>> wording, combining the first two paragraphs:
>>
>>    Upon receipt of the challenge message, the client will complete
>>    its part of of the SPAKE algorithm, generating a public key and
>>    computing the shared secret K. Next, the client chooses one of the
>>    second factor types [...]
> 
> Hmmm. I still wasn’t interpreting it right. If you say “next” I wonder what the preceding “first” or “next” was. I didn’t have an explicit referent to halt my mental search. In this case I think it’s:

Perhaps using "then" instead of next will help?  Current proposed
wording (with some minor edits to the later sentences):

    Upon receipt of the challenge message, the client will complete
    its part of of the SPAKE algorithm, generating a public key and
    computing the shared secret K. The client will then choose one of
    the second factor types listed in the factors field of the challenge
    message and gather whatever data is required for the chosen second
    factor type, possibly using the associated challenge data. Finally,
    the client will send an AS-REQ containing a PA-SPAKE PA-DATA
    element using the response choice.