Re: [kitten] Kathleen Moriarty's Discuss on draft-ietf-kitten-pkinit-freshness-07: (with DISCUSS)

[Stephen Farrell <[e-mail]>]

Hi Kathleen, Kitten-WG:

I read the thread on this and I think a suggestion made
on the kitten list [1] by Greg Hudson ought work to
address the valid concern that a too-short or predictable
freshness token could be abused.

The suggestion was to add a new paragraph to the security
considerations saying:

"If freshness tokens sent by the KDC are too short or too
predictable, an attacker may be able to defeat the mechanism
by creating signatures using every possible token value.
To prevent this attack, the freshness token SHOULD contain
a minimum of 64 unpredictable bits."

If that works, I can add an RFC editor note to that effect
or the authors can fire out a new draft.

Greg also said: "I am willing to accept an amendment changing
64 to 96 or 128.  It's a SHOULD, so it doesn't really constrain
the implementation." And I agree that any of those numbers
would likely be fine.

So:

Kathleen - do you think that'd be sufficient to resolve your
discuss? If not, what would work?

(If the above is good enough to get the discuss cleared, then
I'll ask for opinions from the WG as to whether there are any
issues with it. But please hold off for now until we see if
Kathleen is ok with this resolution.)

Thanks,
S.

PS: Be nice to get this sorted before the holidays:-)

[1] https://www.ietf.org/mail-archive/web/kitten/current/msg06199.html

On 30/11/16 02:21, Kathleen Moriarty wrote:
> Kathleen Moriarty has entered the following ballot position for
> draft-ietf-kitten-pkinit-freshness-07: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-kitten-pkinit-freshness/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> Holding a discuss until the Gen-art conversation on minimum size of the
> fressness token resolves.  Will switch to a yes once that is resolved.
> https://www.ietf.org/mail-archive/web/gen-art/current/msg13942.html
> 
> 
> 
> 
> _______________________________________________
> Kitten mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/kitten
>