Subject: [AAA-WG]: Issue 142: CEKMaxDecrypts value cs DSA length

From: Pat Calhoun <[email-masked]>
Date: Mon, 27 Aug 2001 13:49:03 -0700

Miguel,

I'm not sure if you are genuinely confused, or if you were just making a
point, but the difference between both is that the CEKMaxDecrypts
is used throughout the length of a DSA. The CEK draft discusses how 
keys are re-used within CMS, so this happens within the CMS protocol.
The DSA TTL, however, states when the DSA expires, and a new DSAR message
needs to be sent.

Is this clearer? I'm not sure how to express this in ascii, since one really
does have to read the CEK spec to understand this anyways.

thoughts?

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 28 Aug 2001 09:35:08 +0200

Pat Calhoun wrote:
> point,

Just making a point.

> but the difference between both is that the CEKMaxDecrypts
> Is this clearer?

Yes. It's clear. That's what I thought but I just wanted to know
whether I was right. My basic pursose is to make the specification as
accurate as possible to prevent any possible error in
implementation...

A paragraph similar to the previous by you would be very explicit (but
it's up to you).

Regards

  // M.A.

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 29 Aug 2001 04:50:57 -0700

> A paragraph similar to the previous by you would be very explicit (but

Added the following paragraph to the end of 3.4:

"  Note that the CEKMaxDecrypts value used does not affect the DSA-TTL.
   The DSA-TTL dictates the lifetime of the DSA, while the CEKMaxDecrypts
   dictates how often rekeying will occur within the CMS protocol."

Is this sufficient?

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Wed, 29 Aug 2001 14:48:20 +0200

>    dictates how often rekeying will occur within the CMS protocol."

I would add "A content encryption key MUST NOT be reused once the DSA
has expired".

Regards

  // M.A.

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 29 Aug 2001 05:37:29 -0700

> I would add "A content encryption key MUST NOT be reused once the DSA

done.

PatC