Re: [kitten] Comments on draft-ietf-kitten-krb-spake-preauth-00

[Benjamin Kaduk <[e-mail]>]

On Mon, Aug 14, 2017 at 02:01:48PM -0400, Greg Hudson wrote:
> On 08/14/2017 01:30 PM, Henry B (Hank) Hotz, CISSP wrote:
> >>> [NIT] Section 4.3, para 2: Delete the word “Next”. On my first reading that led me to think it was describing what to do after “the client completes. . .”. It actually describes the *first* thing to do (in the third pass). I’ve now read it enough times that I’m no longer qualified to say how important that is.
> >>
> >> The word "Next" is intended, but I can see that "will complete its part
> >> of the SPAKE process" is too vague--it is not clear that it is
> >> describing a computation step with no protocol messages.  I propose this
> >> wording, combining the first two paragraphs:
> >>
> >>    Upon receipt of the challenge message, the client will complete
> >>    its part of of the SPAKE algorithm, generating a public key and
> >>    computing the shared secret K. Next, the client chooses one of the
> >>    second factor types [...]
> > 
> > Hmmm. I still wasn’t interpreting it right. If you say “next” I wonder what the preceding “first” or “next” was. I didn’t have an explicit referent to halt my mental search. In this case I think it’s:
> 
> Perhaps using "then" instead of next will help?  Current proposed
> wording (with some minor edits to the later sentences):

I don't think "next" vs. "then" is a big difference, it's more a question
of whether the first sentence is giving an overview of what will happen
in the section, or just the first step in what happens.  (When Henry
first mentioned it, I thought it was the former, but now see it's the latter.)

>     Upon receipt of the challenge message, the client will complete
>     its part of of the SPAKE algorithm, generating a public key and
>     computing the shared secret K. The client will then choose one of
>     the second factor types listed in the factors field of the challenge
>     message and gather whatever data is required for the chosen second
>     factor type, possibly using the associated challenge data. Finally,
>     the client will send an AS-REQ containing a PA-SPAKE PA-DATA
>     element using the response choice.

I think that's more clear, thanks.

-Ben