Subject: (LAST CALL) Re: Implicit server authentication: Proposed clarification

From: Bill Sommerfeld <[email-masked]>
Date: Fri, 19 Dec 2003 13:08:05 -0500

[Sorry for the delay in dealing with this loose end.]

Seeing no further followup to this thread, I'm going to suggest a
slight modification to Niels's text:

He wrote:
   All currently defined key exchange methods use explicit server
   authentication.  

This is a little vague for my tastes; I'd say 

   The key exchange method defined in this documents use explicit server 
   authentication.

.. and then have dh-group-exchange and gsskeyex say the same..

This makes the change the following:

Before:

   Server authentication in the key exchange MAY be implicit.  After a
   key exchange with implicit server authentication, the client MUST
   wait for response to its service request message before sending any
   further data.

After:

   A key exchange method uses "explicit server authentication" if the
   key exchange messages include a signature or other proof of the
   server's authenticity.  A key exchange method uses "implicit server
   authentication" if, in order to prove its autenticity, the server
   also has to prove that it knows the shared secret K, by sending a
   message and a corresponding MAC which the client can verify. [1]

   The key exchange method defined by this document uses explicit server 
   authentication.  However, key exchange methods with implicit server
   authentication MAY be used with this protocol.  After a key exchange
   with implicit server authentication, the client MUST wait for
   response to its service request message before sending any further
   data.

Please send comments on this proposed change to the WG list by Monday,
January 4th, 2004.

					- Bill

---

From: Jon Bright <[email-masked]>
Date: Fri, 19 Dec 2003 21:19:01 +0100

>    The key exchange method defined in this documents use explicit server 

Typo - "methods...in these documents use" or "method...in this document 
uses".

> After:
...
>    authentication" if, in order to prove its autenticity, the server
"authenticity"
>    response to its service request message before sending any further
"wait for *a* response"

--
Jon Bright
Silicon Circus Ltd.
http://www.siliconcircus.com

---

From: [email-masked] (Niels Möller)
Date: 19 Dec 2003 23:59:32 +0100

>    message and a corresponding MAC which the client can verify. [1]
                                                                  ^^^

This should be deleted. I referred to a footnote in my email, which
nobody has commented so far.

/Niels

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 19 Dec 2003 18:14:22 -0500

> nobody has commented so far.

I suppose I should comment explicitly.  I have no objection to the intent 
of the proposed text.  I guess I am a little concerned that the "implicit" 
definition is still not specific enough.  It's not clear from that text 
whether "implicit" authentication means that the server sends a message and 
MAC _as part of_ the key exchange, or that its identity is not known 
unless/until it does so _after_ the key exchange.  From context I know it 
is the latter.  I might suggest...

... if, after key exchange, the server's identity(*) is not proven until it 
has demonstrated knowledge of the shared secret K, by sending a message and 
a corresponding MAC which the client can verify.

(*) identiy, authenticity, etc.  Use whatever word you want here.