Re: [kitten] I-D Action: draft-ietf-kitten-pkinit-freshness-00.txt

[Greg Hudson <[e-mail]>]

I have some questions, mostly related to PA-AS-FRESHNESS-REQUEST:

1. Is this padata type needed at all?  The only benefit I can see is
that KDCs can omit PA-AS-FRESHNESS from the PREAUTH_REQUIRED hint list
if the client doesn't support it, but that benefit vanishes as more
clients support the new feature.

2. If it is needed, does it need to have a different padata type value
from PA-AS-FRESHNESS?

3. The draft defines "PA-AS-FRESHNESS-REQUEST ::= NULL".  Is the intent
that the client will use a padata-value of 05 00 (an ASN.1 NULL value
encoded in DER)?  An empty padata-value would be more traditional and
more compact.

4. The draft defines "PA-AS-FRESHNESS ::= OCTET STRING".  Is it
desirable to wrap the freshness token in a DER OCTET STRING tag, or
could we just transmit the value directly within the padata-value?  Of
course the value still needs to have type OCTET STRING within the
PKAuthenticator.

5. It looks like this mechanism is general enough to be used by other
preauthentication mechanisms in the future, if they have similar
requirements.  Perhaps the RFC should explicitly call out that possibility.