[Ietf-krb-wg] FW: New Version Notification for draft-ietf-krb-wg-otp-preauth-13

[<[e-mail]>]

I have submitted an update to the OTP pre-auth draft following the recent WG last call.

The main changes are as follows:

1) Updated PIN change (section 2.3) to not return a ticket for the PIN change service but to instead return a KRB_ERR_PIN_EXPIRED

2) KDC Chellenge (Section 3.2)
	a) Changed first paragraph to refer to description of KRB-ERROR from draft-ietf-krb-wg-otp-preauth-17

	b) Made the control of whether OTPs should be encrypted token specific and so moved the "must-encrypt-nonce" flag from the main PA-OTP-CHALLENGE into the per-token otp-keyInfo

	c) Made the hashing of OTP values token specific and so moved the supportedHashAlg and iterationCount elements to the otp-KeyInfo

	d) Added text clarifying how the "must-encrypt-nonce", supportedHashAlg and iterationCount elements are set.

	e) Since elements are moved from the main PA-OTP-CHALLENGE to the otp-keyInfo, the PA-OTP-CHALLENGE must now contain at least one otp-keyInfo

3) Client Response (section 3.3)
	a) Expanded text to clarfify how the client handles the collection of the PIN
	
	b) Added text to clarify how the client handles challenge-response tokens and the "combine" flag

	c) Clarified when the OTP value is included in the response.  

	d) Clarified how the otp-service, otp-vendor, otp-keyID, otp-length and otp-algID fields of the PA-OTP-CHALLENGE are used.

	e) Added otp-vendor to the PA-OTP-REQUEST

	f) Added text clarifying how the "must-encrypt-nonce", supportedHashAlg and iterationCount elements are used by the client.

5) Reply Key Change (section 3.5)
	a) Removed the PA-OTP-CONFIRM and allowed reply-key change to be done using the encryption in the AS-REP
	
	b) Made nonce in client's PA-OTP-REQUEST optional as it is now only used in the hashing of OTP values and not returned encrypted in the PA-OTP-CONFIRM

6) Key Generation (seciton 3.6)
	a) Added paragraph regarding the strengthen-key in the KrbFastResponse

	b) Base64 encoded OTP values always used in string-to-key

	c) Changed octet string values used in KRB-FX-CF2 to be "OTPComb1" etc

	d) Made the parameters used for string-to-key the enctype of the armor key, the salt of the principal and the default values for the enctype

7) Updated references to draft-ietf-krb-wg-anon, draft-ietf-keyprov-pskc and draft-ietf-krb-wg-otp-preauth  

8) Added text to "IANA Considerations" (section 5) regading the pre-auth types and error codes

9) Updated "Security Considerations" section on replay (section 6.4) regarding OTP replay 

-----Original Message-----
From: IETF I-D Submission Tool [mailto:[e-mail]] 
Sent: 27 September 2010 13:29
To: Richards, Gareth
Subject: New Version Notification for draft-ietf-krb-wg-otp-preauth-13 


A new version of I-D, draft-ietf-krb-wg-otp-preauth-13.txt has been successfully submitted by Gareth Richards and posted to the IETF repository.

Filename:	 draft-ietf-krb-wg-otp-preauth
Revision:	 13
Title:		 OTP Pre-authentication
Creation_date:	 2010-09-27
WG ID:		 krb-wg
Number_of_pages: 39

Abstract:
The Kerberos protocol provides a framework authenticating a client using the exchange of pre-authentication data.  This document describes the use of this framework to carry out One Time Password
(OTP) authentication.
                                                                                  


The IETF Secretariat.



_______________________________________________
ietf-krb-wg mailing list
[e-mail]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg