Re: [kitten] PKCROSS

["Henry B. Hotz" <[e-mail]>]

On Jul 11, 2013, at 2:40 PM, Nico Williams <[e-mail]> wrote:

> I note this text in the current charter:
> 
>  Prepare a standards-track protocol to solve the use cases addressed
>        by draft-hotz-kx509-01 including new support for digital
>        signatures.

Yeah, I really, really need to get back to this.

> The thought occurs that Kerberos + kx509 + PKINIT can be a sort of
> PKCROSS.  

Please elaborate?

The reason *I* would combine kx509 with PKINIT would be the use case of someone needing X.509 credentials on multiple client computers at once.  This is a real use case for us.

I was thinking of PKCROSS the other day as a possible solution to a rather specialized problem:  our realm-name conflict between Unix and AD kerberos.  You might think that for one-way trusts from another realm (like a smart-card-only realm) it would be OK to have both of them trust the other one.  Trouble is that with symmetric crypto if someone hacked the AD realm they could use the one-way trust key to forge other-realm cross-realm authentications to the Unix realm.  (Not picking on Microsoft.  The problem is symmetric.) I suspect that PKCROSS might allow a solution to that, though I have not read the draft to make sure.  I also suspect that it's too specialized a use case to justify the standards effort that would be required.

> That makes me very interested.  It shouldn't be very
> difficult to build that almost entirely out of off-the-shelf protocol
> pieces.  It's not trival though: we'd definitely need policy for
> handling PKIX trust paths,

I've lost a lot of interest in PKIX, per-se.  The overall revocation system is architecturally broken, and I can't tell if the co-chairs even understand the issues.  Instead we have vapor-ware like SCVP and TAMP.

> and it wouldn't minimize the need for PK
> crypto.
> 
> PKCROSS -or similar- is not in-charter at this time.


If we can address use cases which PKIX doesn't, then it sounds valuable.
------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[e-mail], or [e-mail]