Skip to main content

Cryptographic Message Syntax (CMS) Symmetric Key Package Content Type
RFC 6031

Revision differences

Document history

Date Rev. By Action
2020-01-21
11 (System) Received changes through RFC Editor sync (added Verified Errata tag)
2015-10-14
11 (System) Notify list changed from keyprov-chairs@ietf.org, draft-ietf-keyprov-symmetrickeyformat@ietf.org to (None)
2012-08-22
11 (System) post-migration administrative database adjustment to the No Objection position for Peter Saint-Andre
2012-08-22
11 (System) post-migration administrative database adjustment to the No Objection position for Jari Arkko
2012-08-22
11 (System) post-migration administrative database adjustment to the No Objection position for Dan Romascanu
2010-12-13
11 Cindy Morgan State changed to RFC Published from RFC Ed Queue.
2010-12-13
11 Cindy Morgan [Note]: changed to 'RFC 6031'
2010-12-13
11 (System) RFC published
2010-08-10
11 (System) IANA Action state changed to No IC from In Progress
2010-08-10
11 (System) IANA Action state changed to In Progress
2010-08-10
11 Cindy Morgan State Changes to RFC Ed Queue from Approved-announcement sent by Cindy Morgan
2010-08-10
11 Cindy Morgan IESG state changed to Approved-announcement sent
2010-08-10
11 Cindy Morgan IESG has approved the document
2010-08-10
11 Cindy Morgan Closed "Approve" ballot
2010-08-09
11 Jari Arkko [Ballot Position Update] Position for Jari Arkko has been changed to No Objection from Discuss by Jari Arkko
2010-08-09
11 Alexey Melnikov [Ballot Position Update] Position for Alexey Melnikov has been changed to No Objection from Discuss by Alexey Melnikov
2010-08-09
11 Alexey Melnikov [Ballot discuss]
2010-08-09
11 (System) New version available: draft-ietf-keyprov-symmetrickeyformat-11.txt
2010-08-09
11 Dan Romascanu [Ballot Position Update] Position for Dan Romascanu has been changed to No Objection from Discuss by Dan Romascanu
2010-08-09
11 David Harrington [Ballot Position Update] Position for David Harrington has been changed to No Objection from Discuss by David Harrington
2010-08-05
11 Alexey Melnikov
[Ballot discuss]
Updated as per the latest revision:

1) 3.1.1.7

  The date MUST be expressed in canonical form with no time zone component.

Sorry …
[Ballot discuss]
Updated as per the latest revision:

1) 3.1.1.7

  The date MUST be expressed in canonical form with no time zone component.

Sorry for not catching this earlier: does this mean that the time zone is ommitted from the representation? I think the omitted timezone means "local timezone", which contradicts "in UTC form".

You probably want to say that the dateTime is in the "canonical representation", as per XMLSchema, part 2, Section "3.2.7.2 Canonical representation":

------

Except for trailing fractional zero digits in the seconds representation, '24:00:00' time representations, and timezone (for timezoned values), the mapping from literals to values is one-to-one. Where there is more than one possible representation, the canonical representation is as follows:

    * The 2-digit numeral representing the hour must not be '24';
    * The fractional second string, if present, must not end in '0';
    * for timezoned values, the timezone must be represented with 'Z' (All timezoned dateTime values are UTC.).

------

Similar issues in several other sections.
2010-08-05
11 Alexey Melnikov
[Ballot discuss]
Updated as per the latest revision:

1) 3.1.1.7
  The date MUST be represented
  in a form that matches the dateTime production …
[Ballot discuss]
Updated as per the latest revision:

1) 3.1.1.7
  The date MUST be represented
  in a form that matches the dateTime production from [XMLSCHEMA].

This Normative reference is not listed in the list of references.

  The date MUST be expressed in UTC form with no time zone component.

Sorry for not catching this earlier: does this mean that the time zone is ommitted from the representation? I think the omitted timezone means "local timezone", which contradicts "in UTC form".

You probably want to say that the dateTime is in the "canonical representation", as per XMLSchema, part 2, Section "3.2.7.2 Canonical representation":

------

Except for trailing fractional zero digits in the seconds representation, '24:00:00' time representations, and timezone (for timezoned values), the mapping from literals to values is one-to-one. Where there is more than one possible representation, the canonical representation is as follows:

    * The 2-digit numeral representing the hour must not be '24';
    * The fractional second string, if present, must not end in '0';
    * for timezoned values, the timezone must be represented with 'Z' (All timezoned dateTime values are UTC.).

------

Similar issues in several other sections.
2010-08-05
10 (System) New version available: draft-ietf-keyprov-symmetrickeyformat-10.txt
2010-07-11
11 Alexey Melnikov
[Ballot discuss]
Updated as per the latest revision:

1) 3.1.1.7
  The date MUST be represented
  in a form that matches the dateTime production …
[Ballot discuss]
Updated as per the latest revision:

1) 3.1.1.7
  The date MUST be represented
  in a form that matches the dateTime production from [XMLSCHEMA].

This Normative reference is not listed in the list of references.

  The date MUST be expressed in UTC form with no time zone component.

Sorry for not catching this earlier: does this mean that the time zone is ommitted from the representation? I think the omitted timezone means "local timezone", which contradicts "in UTC form".

You probably want to say that the dateTime is in the "canonical representation", as per XMLSchema, part 2, Section "3.2.7.2 Canonical representation":

------

Except for trailing fractional zero digits in the seconds representation, '24:00:00' time representations, and timezone (for timezoned values), the mapping from literals to values is one-to-one. Where there is more than one possible representation, the canonical representation is as follows:

    * The 2-digit numeral representing the hour must not be '24';
    * The fractional second string, if present, must not end in '0';
    * for timezoned values, the timezone must be represented with 'Z' (All timezoned dateTime values are UTC.).

------

Similar issues in several other sections.


2) 3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device.
  Values for Manufacturer SHOULD be taken from either [OATHMAN]
  prefixes (i.e., the left column) or they SHOULD be taken from IANA
  Private Enterprise Number Registry [IANAPENREG], using the
  Organisation value.

The document should allow a way to distinguish values from 2 registries, as they may overlap. For example a unique prefix can be used for one or both of them.
2010-07-11
11 Alexey Melnikov
[Ballot discuss]
Updated as per the latest revision:

1) 3.1.1.7
  The date MUST be represented
  in a form that matches the dateTime production …
[Ballot discuss]
Updated as per the latest revision:

1) 3.1.1.7
  The date MUST be represented
  in a form that matches the dateTime production from [XMLSCHEMA].

This Normative reference is not listed in the list of references.

  The date MUST be expressed in UTC form with no time zone component.

Sorry for not catching this earlier: does this mean that the time zone is ommitted from the representation? I think the omitted timezone means "local timezone", which contradicts "in UTC form".


Similar issues in several other sections.


2) 3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device.
  Values for Manufacturer SHOULD be taken from either [OATHMAN]
  prefixes (i.e., the left column) or they SHOULD be taken from IANA
  Private Enterprise Number Registry [IANAPENREG], using the
  Organisation value.

The document should allow a way to distinguish values from 2 registries, as they may overlap. For example a unique prefix can be used for one or both of them.
2010-07-08
11 Alexey Melnikov
[Ballot discuss]
3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device.
  Values for Manufacturer SHOULD be taken from either [OATHMAN]
  …
[Ballot discuss]
3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device.
  Values for Manufacturer SHOULD be taken from either [OATHMAN]
  prefixes (i.e., the left column) or they SHOULD be taken from IANA
  Private Enterprise Number Registry [IANAPENREG], using the
  Organisation value.

The document should allow a way to distinguish values from 2 registries, as they may overlap. For example a unique prefix can be used for one or both of them.
2010-07-08
11 Peter Saint-Andre [Ballot discuss]
[cleared]
2010-07-08
11 Peter Saint-Andre [Ballot Position Update] Position for Peter Saint-Andre has been changed to No Objection from Discuss by Peter Saint-Andre
2010-07-08
11 (System) Sub state has been changed to AD Follow up from New Id Needed
2010-07-08
09 (System) New version available: draft-ietf-keyprov-symmetrickeyformat-09.txt
2010-05-27
11 Tim Polk State Changes to IESG Evaluation::Revised ID Needed from Waiting for AD Go-Ahead by Tim Polk
2010-05-12
11 (System) State has been changed to Waiting for AD Go-Ahead from Revised ID Needed by system
2010-05-07
11 Amanda Baber
IANA questions/comments:

As described in the IANA Considerations section, we understand this
document to have NO IANA Actions. However, this document refers to an OID …
IANA questions/comments:

As described in the IANA Considerations section, we understand this
document to have NO IANA Actions. However, this document refers to an OID that IANA has already assigned to the SMIME working group, and we're not sure what that is. Is this referring to the arc assigned to the PKIX WG (1.3.6.1.5.5.7)?
2010-05-06
11 Cindy Morgan State Changes to In Last Call::Revised ID Needed from In Last Call by Cindy Morgan
2010-05-06
11 Dan Romascanu [Ballot discuss]
In support to Alexey DISCUSS DISCUSS on the manufacturer attribute - why not use the Enterprise number registry at http://www.iana.org/assignments/enterprise-numbers?
2010-05-06
11 Dan Romascanu [Ballot Position Update] New position, Discuss, has been recorded by Dan Romascanu
2010-05-06
11 Jari Arkko
[Ballot discuss]
This document specifies a format that carries a lot of information but at
least for some attributes there are very little semantics associated …
[Ballot discuss]
This document specifies a format that carries a lot of information but at
least for some attributes there are very little semantics associated with
them. Its easy to understand some of the attributes, but for instance
Device Start Date and Device Expiry Date do not seem obvious. I also
checked the references and I could not find an explanation of what
implementations are expected to do with these. What is the relationship
to key lifetime? If the current time is outside device lifetime, just the
key is invalid, or the device must never again be touched?

What is the name space used for device identifiers and is there a
possibility that, say, key meant for IMEI 12345 is used for some
company's device with serial number 12345?
2010-05-06
11 Jari Arkko [Ballot Position Update] New position, Discuss, has been recorded by Jari Arkko
2010-05-06
11 Gonzalo Camarillo [Ballot Position Update] New position, No Objection, has been recorded by Gonzalo Camarillo
2010-05-06
11 Adrian Farrel [Ballot Position Update] New position, No Objection, has been recorded by Adrian Farrel
2010-05-06
11 Adrian Farrel
[Ballot comment]
Agree with Peter's Discuss point 3.
We need some clarity on this reference and the algorithm.
It would seem that the patent is …
[Ballot comment]
Agree with Peter's Discuss point 3.
We need some clarity on this reference and the algorithm.
It would seem that the patent is very old, and this may mitigate the absence of a patent disclosure. However, in this case, I would expect this document to make some attempt to be self-contained or to refer to another specification for the details of the Luhn check digit.
2010-05-05
11 Peter Saint-Andre
[Ballot discuss]
1. The precise formats for Device Start Date, Device Expiry Date, Key Start Date, and Key Expiry Date are not specified. Use of …
[Ballot discuss]
1. The precise formats for Device Start Date, Device Expiry Date, Key Start Date, and Key Expiry Date are not specified. Use of the Internet Date/Time Format from Section 5.6 of RFC 3339 is generally recommended for RFCs.

2. The specification says that "the friendlyNameLangTag should be a language tag as described in [RFC5646]." Why not MUST?

3. I second Alexey's DISCUSS about the [LUHN] reference. Furthermore, given that the reference is to a patent or patent application, has an IPR statement been filed?

4. Is the time interval value to be measured in number of seconds?

5. No guidance is provided regarding values for 'maxFailedAttempts'; for
example, a reasonable number of retries might be at least 2 and no more than 5.
2010-05-05
11 Peter Saint-Andre
[Ballot discuss]
The precise formats for Device Start Date and Device Expiry Date are not specified. Use of the Internet Date/Time Format from Section 5.6 …
[Ballot discuss]
The precise formats for Device Start Date and Device Expiry Date are not specified. Use of the Internet Date/Time Format from Section 5.6 of RFC 3339 is generally recommended.
2010-05-05
11 Peter Saint-Andre [Ballot Position Update] New position, Discuss, has been recorded by Peter Saint-Andre
2010-05-05
11 Robert Sparks [Ballot Position Update] New position, No Objection, has been recorded by Robert Sparks
2010-05-05
11 Ron Bonica [Ballot Position Update] New position, No Objection, has been recorded by Ron Bonica
2010-05-04
11 Russ Housley [Ballot Position Update] New position, Recuse, has been recorded by Russ Housley
2010-05-03
11 Alexey Melnikov
[Ballot discuss]
3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device. 
  The attribute definition is as follows:

  at-pskc-manufacturer ATTRIBUTE ::= …
[Ballot discuss]
3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device. 
  The attribute definition is as follows:

  at-pskc-manufacturer ATTRIBUTE ::= {
    TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }

DISCUSS DISCUSS: Is there any IANA registry that can be recommended for use in this field?

3.2.6. Friendly Name

  The Friendly Name attribute contains a human readable name for the
  secret key.  The attribute definition is as follows:

  at-pskc-friendlyName ATTRIBUTE ::= {
    TYPE UTF8String IDENTIFIED BY id-pskc-friendlyName }

  id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 }

  The text is encoded in UTF-8 [RFC3629], which accommodates most of
  the world's writing systems.  The friendlyNameLangTag field
  identifies the language used to express the friendlyName.  When
  friendlyNameLangTag is absent, English is used.

Comment: please mention the associated language tag "en".

  The value of the
  friendlyNameLangTag should be a language tag as described in
  [RFC5646].

I don't see where friendlyNameLangTag is defined.

7.1. Normative References

  [LUHN] Luhn, H., "Luhn algorithm", US Patent 2950048, August 1960,
  http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=2950048.

This looks like a DOWNREF now.

Addditionally, Simon Josefsson wrote during the Second IETF LC:

>More worrisome, I cannot read the reference.  The link goes to a page
>which says 'Full text is not available for this patent.  Click on
>"Images" button above to view full patent' and when I click on "Images"
>I get nothing because the page appears to require some non-standard
>plugin that I don't have installed.

This doesn't look like a good and stable normative reference. I think it would be better to describe the algorithm inline (and have an Informative reference to the patent), if it is simple.


draft-ietf-keyprov-pskc-05.txt defines <UserId> XML element. There is no mapping of it in this document.
2010-05-03
11 David Harrington
[Ballot discuss]
in 3.2.1, how does the key identifier attribute guarantee uniqueness? Across what administrative domain must the key be unique? is there a registry? …
[Ballot discuss]
in 3.2.1, how does the key identifier attribute guarantee uniqueness? Across what administrative domain must the key be unique? is there a registry? if so, how are assignments to the registry made (as compared to say the mechanisms such as IETF Review used by IANA?
2010-05-03
11 David Harrington
[Ballot discuss]
in 3.2.1, how does the key identifier attribute gurantee uniqueness? Across what administrative domain must the key be unique? is there a registry? …
[Ballot discuss]
in 3.2.1, how does the key identifier attribute gurantee uniqueness? Across what administrative domain must the key be unique? is there a registry? if so, how are assignments to the registry made (as compared to say the mechanisms such as IETF Review used by IANA?
2010-05-03
11 David Harrington [Ballot Position Update] New position, Discuss, has been recorded by David Harrington
2010-04-29
11 Alexey Melnikov
[Ballot discuss]
3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device. 
  The attribute definition is as follows:

  at-pskc-manufacturer ATTRIBUTE ::= …
[Ballot discuss]
3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device. 
  The attribute definition is as follows:

  at-pskc-manufacturer ATTRIBUTE ::= {
    TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }

DISCUSS DISCUSS: Is there any IANA registry that can be recommended for use in this field?

3.2.6. Friendly Name

  The Friendly Name attribute contains a human readable name for the
  secret key.  The attribute definition is as follows:

  at-pskc-friendlyName ATTRIBUTE ::= {
    TYPE UTF8String IDENTIFIED BY id-pskc-friendlyName }

  id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 }

  The text is encoded in UTF-8 [RFC3629], which accommodates most of
  the world's writing systems.  The friendlyNameLangTag field
  identifies the language used to express the friendlyName.  When
  friendlyNameLangTag is absent, English is used.

Comment: please mention the associated language tag "en".

  The value of the
  friendlyNameLangTag should be a language tag as described in
  [RFC5646].

I don't see where friendlyNameLangTag is defined.

7.1. Normative References

  [LUHN] Luhn, H., "Luhn algorithm", US Patent 2950048, August 1960,
  http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=2950048.

This looks like a DOWNREF now.

Addditionally, Simon Josefsson wrote during the Second IETF LC:

>More worrisome, I cannot read the reference.  The link goes to a page
>which says 'Full text is not available for this patent.  Click on
>"Images" button above to view full patent' and when I click on "Images"
>I get nothing because the page appears to require some non-standard
>plugin that I don't have installed.

This doesn't look like a good and stable normative reference. I think it would be better to describe the algorithm inline (and have an Informative reference to the patent), if it is simple.
2010-04-28
11 Alexey Melnikov
[Ballot discuss]
[Updated]

3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device. 
  The attribute definition is as follows:

  at-pskc-manufacturer ATTRIBUTE …
[Ballot discuss]
[Updated]

3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device. 
  The attribute definition is as follows:

  at-pskc-manufacturer ATTRIBUTE ::= {
    TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }

DISCUSS DISCUSS: Is there any IANA registry that can be recommended for use in this field?

3.2.2. Algorithm

  The Algorithm attribute uniquely identifies the PSKC algorithm
  profile.  [PSKC] defines two algorithm profiles "HOTP" and
  "KEYPROV-PIN".

DISCUSS DISCUSS: It looks like this attribute needs an IANA registry. I am Ok if it is defined in [PSKC], or if you can argue why you don't need one.

3.2.6. Friendly Name

  The Friendly Name attribute contains a human readable name for the
  secret key.  The attribute definition is as follows:

  at-pskc-friendlyName ATTRIBUTE ::= {
    TYPE UTF8String IDENTIFIED BY id-pskc-friendlyName }

  id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 }

  The text is encoded in UTF-8 [RFC3629], which accommodates most of
  the world's writing systems.  The friendlyNameLangTag field
  identifies the language used to express the friendlyName.  When
  friendlyNameLangTag is absent, English is used.

Comment: please mention the associated language tag, e.g. '("en")'

  The value of the
  friendlyNameLangTag should be a language tag as described in
  [RFC5646].

I don't see where friendlyNameLangTag is defined.


3.3.5:

o pinUsageMode indicates the way the PIN is used during the usage of
    the key.  The following values are defined: Local, Prepend,
    Append, Algorithmic.

The meaning of the choices is not clear to me. So I don't think
they can be used in an interoperable fashion.
<<Alexey's ToDo: Check [PSKC].>>

7.1. Normative References

  [LUHN] Luhn, H., "Luhn algorithm", US Patent 2950048, August 1960,
  http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=2950048.

This looks like a DOWNREF now.

Addditionally, Simon Josefsson wrote during the Second IETF LC:

>More worrisome, I cannot read the reference.  The link goes to a page
>which says 'Full text is not available for this patent.  Click on
>"Images" button above to view full patent' and when I click on "Images"
>I get nothing because the page appears to require some non-standard
>plugin that I don't have installed.

This doesn't look like a good and stable normative reference. I think it would be better to describe the algorithm inline (and have an Informative reference to the patent), if it is simple.
2010-04-28
11 Cindy Morgan Last call sent
2010-04-28
11 Cindy Morgan State Changes to In Last Call from Last Call Requested by Cindy Morgan
2010-04-28
11 Tim Polk Last Call was requested by Tim Polk
2010-04-28
11 Tim Polk State Changes to Last Call Requested from Waiting for AD Go-Ahead by Tim Polk
2010-04-27
11 Samuel Weiler Request for Last Call review by SECDIR Completed. Reviewer: Joseph Salowey.
2010-04-26
11 Amanda Baber IANA comments:

As described in the IANA Considerations section, we understand this
document to have NO IANA Actions.
2010-04-26
11 Alexey Melnikov [Ballot comment]
2010-04-26
11 Alexey Melnikov
[Ballot discuss]
3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device. 
  The attribute definition is as follows:

  at-pskc-manufacturer ATTRIBUTE ::= …
[Ballot discuss]
3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device. 
  The attribute definition is as follows:

  at-pskc-manufacturer ATTRIBUTE ::= {
    TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }

DISCUSS DISCUSS: Is there any IANA registry that can be recommended for use in this field?

3.2.6. Friendly Name

  The Friendly Name attribute contains a human readable name for the
  secret key.  The attribute definition is as follows:

  at-pskc-friendlyName ATTRIBUTE ::= {
    TYPE UTF8String IDENTIFIED BY id-pskc-friendlyName }

<<Language tags>>


3.3.5:

o pinUsageMode indicates the way the PIN is used during the usage of
    the key.  The following values are defined: Local, Prepend,
    Append, Algorithmic.

The meaning of the choices is not clear to me. So I don't think
they can be used in an interoperable fashion.
<<Check [PSKC].>>

7.1. Normative References

  [RFC4049] Housley, R., "BinaryTime: An Alternate Format for
  Representing Date and Time in ASN.1", RFC 4049, April 2005.

DOWNREF to an Experimental RFC.

I am willing to sponsor moving RFC 4049 to Standard Track.

  [LUHN] Luhn, H., "Luhn algorithm", US Patent 2950048, August 1960,
  http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=2950048.

This looks like a DOWNREF now?
2010-04-26
08 (System) New version available: draft-ietf-keyprov-symmetrickeyformat-08.txt
2010-04-26
11 (System) State has been changed to Waiting for AD Go-Ahead from In Last Call by system
2010-04-24
11 Alexey Melnikov
[Ballot comment]
2. Symmetric Key Package Content Type

  This content type must be Distinguished Encoding Rules (DER)
  encoded [X.690].

s/must/MUST ?

3.2.7. Algorithm …
[Ballot comment]
2. Symmetric Key Package Content Type

  This content type must be Distinguished Encoding Rules (DER)
  encoded [X.690].

s/must/MUST ?

3.2.7. Algorithm Parameters

  o min defines the minimum size of the challenge accepted by the
        device for CR mode.  If encoding is 'DECIMAL', 'HEXADECIMAL' or
        'ALPHANUMERIC' this value indicates the minimum number of
        digits/characters.

So just to double check: for a HEXADECIMAL value "ABCD", min is 4, not 2?
(The same question about "max", ResponseFormat/"length", PINPolicy/"minLength" & "maxLength")

        If encoding is 'BASE64' or 'BINARY', this
        value indicates the minimum number of bytes of the unencoded
        value.

4.1. AES Key Encoding

  [FIPS197] section 5.2, titled Key Expansion, uses the input key as an
  array of bytes indexed starting at 0.  The first octet of sKey SHALL
  become the key byte in AES labeled index 0 in [FIPS197] SHALL be the
  first octet of sKey,

COMMENT: Too many SHALLs?

  and the other key bytes SHALL follow in index
  order.
2010-04-24
11 Alexey Melnikov
[Ballot discuss]
3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device. 
  The attribute definition is as follows:

  at-pskc-manufacturer ATTRIBUTE ::= …
[Ballot discuss]
3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device. 
  The attribute definition is as follows:

  at-pskc-manufacturer ATTRIBUTE ::= {
    TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }

DISCUSS DISCUSS: Is there any IANA registry that can be recommended for use in this field?

3.2.6. Friendly Name

  The Friendly Name attribute contains a human readable name for the
  secret key.  The attribute definition is as follows:

  at-pskc-friendlyName ATTRIBUTE ::= {
    TYPE UTF8String IDENTIFIED BY id-pskc-friendlyName }

<<Language tags>>


3.2.7. Algorithm Parameters

Encoding ::= UTF8STRING ("DECIMAL" | "HEXADECIMAL" |
                "ALPHANUMERIC" |"BASE64" |"BINARY")

BASE64 needs a reference.


3.2.12. Value MAC

  o mac is the base64 encoded [RFC4648] mac value.

This should point to a specific section in RFC 4648.

3.3.5:

o pinUsageMode indicates the way the PIN is used during the usage of
    the key.  The following values are defined: Local, Prepend,
    Append, Algorithmic.

The meaning of the choices is not clear to me. So I don't think
they can be used in an interoperable fashion.

6. IANA Considerations

  None: All identifiers are already registered.  Please remove this
  section prior to publication as an RFC.

This doesn't seem to match text elsewhere in the document:

  id-pskc-manufacturer OBJECT IDENTIFIER ::= { TBD }
  id-pskc-serialNo OBJECT IDENTIFIER ::= { TBD }
  id-pskc-model OBJECT IDENTIFIER ::= { TBD }
  id-pskc-issueNo OBJECT IDENTIFIER ::= { TBD }
  id-pskc-deviceBinding OBJECT IDENTIFIER ::= { TBD }
  id-pskc-startDate OBJECT IDENTIFIER ::= { TBD }
  id-pskc-expiryDate OBJECT IDENTIFIER ::= { TBD }
  id-pskc-id OBJECT IDENTIFIER ::= { TBD }
  id-pskc-algorithm OBJECT IDENTIFIER ::= { TBD }
  id-pskc-issuer OBJECT IDENTIFIER ::= { TBD }
  id-pskc-keyProfileId OBJECT IDENTIFIER ::= { TBD }
  id-pskc-keyReference OBJECT IDENTIFIER ::= { TBD }
  id-pskc-friendlyName OBJECT IDENTIFIER ::= { TBD }
  id-pskc-algorithmParameters OBJECT IDENTIFIER ::= { TBD }
  id-pskc-counter OBJECT IDENTIFIER ::= { TBD }
  id-pskc-time OBJECT IDENTIFIER ::= { TBD }
  id-pskc-timeInterval OBJECT IDENTIFIER ::= { TBD }
  id-pskc-timeDrift OBJECT IDENTIFIER ::= { TBD }
  id-pskc-numberOfTransactions OBJECT IDENTIFIER ::= { TBD }
  id-pskc-pinPolicy OBJECT IDENTIFIER ::= { TBD }

Note that there are lots of "TBD"s.


7.1. Normative References

  [RFC4049] Housley, R., "BinaryTime: An Alternate Format for
  Representing Date and Time in ASN.1", RFC 4049, April 2005.

DOWNREF to an Experimental RFC.

I am willing to sponsor moving RFC 4049 to Standard Track.

7.2. Non-Normative References

  [PSKC] Hoyer, P., Pei, M., and S. Machani, "Portable Symmetric Key
  Container (PSKC), draft-ietf-keyprov-pskc-05.txt, work-in-progress.

This reference looks Normative, because it defines the normative XML representation

  [PSKC-ALGORITHM-PROFILES] Hoyer, P., Pei, M., Machani, S., and A.
  Doherty, "Additional Portable Symmetric Key Container (PSKC)
  Algorithm Profiles", Internet Draft Informational, URL:
  http://tools.ietf.org/html/draft-hoyer-keyprov-pskc-algorithm-
  profiles-00, December 2008.

Use in Section 3.2.2 seems Normative to me.

  [LUHN] Luhn, H., "Luhn algorithm", US Patent 2950048, August 1960,
  http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=2950048.

Use in Section 3.2.7 looks Normative to me.
2010-04-24
11 Alexey Melnikov
[Ballot comment]
2. Symmetric Key Package Content Type

  This content type must be Distinguished Encoding Rules (DER)
  encoded [X.690].

s/must/MUST ?

3.2.7. Algorithm …
[Ballot comment]
2. Symmetric Key Package Content Type

  This content type must be Distinguished Encoding Rules (DER)
  encoded [X.690].

s/must/MUST ?

3.2.7. Algorithm Parameters

  o min defines the minimum size of the challenge accepted by the
        device for CR mode.  If encoding is 'DECIMAL', 'HEXADECIMAL' or
        'ALPHANUMERIC' this value indicates the minimum number of
        digits/characters.

So just to double check: for a HEXADECIMAL value "ABCD", min is 4, not 2?
(The same question about "max", ResponseFormat/"length", PINPolicy/"minLength" & "maxLength")

        If encoding is 'BASE64' or 'BINARY', this
        value indicates the minimum number of bytes of the unencoded
        value.

4.1. AES Key Encoding

  [FIPS197] section 5.2, titled Key Expansion, uses the input key as an
  array of bytes indexed starting at 0.  The first octet of sKey SHALL
  become the key byte in AES labeled index 0 in [FIPS197] SHALL be the
  first octet of sKey,

COMMENT: Too many SHALLs?

  and the other key bytes SHALL follow in index
  order.
2010-04-24
11 Alexey Melnikov
[Ballot discuss]
3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device. 
  The attribute definition is as follows:

  at-pskc-manufacturer ATTRIBUTE ::= …
[Ballot discuss]
3.1.1.1. Manufacturer

  The Manufacturer attribute indicates the manufacturer of the device. 
  The attribute definition is as follows:

  at-pskc-manufacturer ATTRIBUTE ::= {
    TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }

DISCUSS DISCUSS: Is there any IANA registry that can be recommended for use in this field?

3.2.6. Friendly Name

  The Friendly Name attribute contains a human readable name for the
  secret key.  The attribute definition is as follows:

  at-pskc-friendlyName ATTRIBUTE ::= {
    TYPE UTF8String IDENTIFIED BY id-pskc-friendlyName }

<<Language tags>>


3.2.7. Algorithm Parameters

Encoding ::= UTF8STRING ("DECIMAL" | "HEXADECIMAL" |
                "ALPHANUMERIC" |"BASE64" |"BINARY")

BASE64 needs a reference.


3.2.12. Value MAC

  o mac is the base64 encoded [RFC4648] mac value.

This should point to a specific section in RFC 4648.

3.3.5:

o pinUsageMode indicates the way the PIN is used during the usage of
    the key.  The following values are defined: Local, Prepend,
    Append, Algorithmic.

The meaning of the choices is not clear to me. So I don't think
they can be used in an interoperable fashion.

6. IANA Considerations

  None: All identifiers are already registered.  Please remove this
  section prior to publication as an RFC.

This doesn't seem to match text elsewhere in the document:

  id-pskc-manufacturer OBJECT IDENTIFIER ::= { TBD }
  id-pskc-serialNo OBJECT IDENTIFIER ::= { TBD }
  id-pskc-model OBJECT IDENTIFIER ::= { TBD }
  id-pskc-issueNo OBJECT IDENTIFIER ::= { TBD }
  id-pskc-deviceBinding OBJECT IDENTIFIER ::= { TBD }
  id-pskc-startDate OBJECT IDENTIFIER ::= { TBD }
  id-pskc-expiryDate OBJECT IDENTIFIER ::= { TBD }
  id-pskc-id OBJECT IDENTIFIER ::= { TBD }
  id-pskc-algorithm OBJECT IDENTIFIER ::= { TBD }
  id-pskc-issuer OBJECT IDENTIFIER ::= { TBD }
  id-pskc-keyProfileId OBJECT IDENTIFIER ::= { TBD }
  id-pskc-keyReference OBJECT IDENTIFIER ::= { TBD }
  id-pskc-friendlyName OBJECT IDENTIFIER ::= { TBD }
  id-pskc-algorithmParameters OBJECT IDENTIFIER ::= { TBD }
  id-pskc-counter OBJECT IDENTIFIER ::= { TBD }
  id-pskc-time OBJECT IDENTIFIER ::= { TBD }
  id-pskc-timeInterval OBJECT IDENTIFIER ::= { TBD }
  id-pskc-timeDrift OBJECT IDENTIFIER ::= { TBD }
  id-pskc-numberOfTransactions OBJECT IDENTIFIER ::= { TBD }
  id-pskc-pinPolicy OBJECT IDENTIFIER ::= { TBD }

Note that there are lots of "TBD"s.


7.1. Normative References

  [RFC4049] Housley, R., "BinaryTime: An Alternate Format for
  Representing Date and Time in ASN.1", RFC 4049, April 2005.

DOWNREF to an Experimental RFC.

I am willing to sponsor moving RFC 4049 to Standard Track.

7.2. Non-Normative References

  [PSKC] Hoyer, P., Pei, M., and S. Machani, "Portable Symmetric Key
  Container (PSKC), draft-ietf-keyprov-pskc-05.txt, work-in-progress.

This reference looks Normative, because it defines the normative XML representation

  [PSKC-ALGORITHM-PROFILES] Hoyer, P., Pei, M., Machani, S., and A.
  Doherty, "Additional Portable Symmetric Key Container (PSKC)
  Algorithm Profiles", Internet Draft Informational, URL:
  http://tools.ietf.org/html/draft-hoyer-keyprov-pskc-algorithm-
  profiles-00, December 2008.

Use in Section 3.2.2 seems Normative to me.

  [LUHN] Luhn, H., "Luhn algorithm", US Patent 2950048, August 1960,
  http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=2950048.

Use in Section 3.2.7 looks Normative to me.
2010-04-24
11 Alexey Melnikov [Ballot Position Update] New position, Discuss, has been recorded by Alexey Melnikov
2010-04-22
11 Sean Turner [Ballot Position Update] New position, Recuse, has been recorded by Sean Turner
2010-04-22
11 Tim Polk [Ballot Position Update] New position, Yes, has been recorded for Tim Polk
2010-04-22
11 Tim Polk Ballot has been issued by Tim Polk
2010-04-22
11 Tim Polk Created "Approve" ballot
2010-04-22
11 Tim Polk Telechat date was changed to 2010-05-06 from  by Tim Polk
2010-04-22
11 Tim Polk Telechat date was changed to 2010-05-06 from  by Tim Polk
2010-04-22
11 Tim Polk Placed on agenda for telechat - 2010-05-06 by Tim Polk
2010-04-22
11 Tim Polk [Note]: 'Document shepherd is Hannes Tschofenig (Hannes.Tschofenig@gmx.net).' added by Tim Polk
2010-04-15
11 Samuel Weiler Request for Last Call review by SECDIR is assigned to Joseph Salowey
2010-04-15
11 Samuel Weiler Request for Last Call review by SECDIR is assigned to Joseph Salowey
2010-04-12
11 Cindy Morgan State Changes to In Last Call from Last Call Requested by Cindy Morgan
2010-04-12
11 Tim Polk State Changes to Last Call Requested from Publication Requested by Tim Polk
2010-04-12
11 Tim Polk Last Call was requested by Tim Polk
2010-04-12
11 (System) Ballot writeup text was added
2010-04-12
11 (System) Last call text was added
2010-04-12
11 (System) Ballot approval text was added
2010-03-02
11 Tim Polk Responsible AD has been changed to Tim Polk from Pasi Eronen
2010-03-01
11 Pasi Eronen

  (1.a)  Who is the Document Shepherd for this document?  Has the
          Document Shepherd personally reviewed this version of the …

  (1.a)  Who is the Document Shepherd for this document?  Has the
          Document Shepherd personally reviewed this version of the
          document and, in particular, does he or she believe this
          version is ready for forwarding to the IESG for publication?

The document shepherd is Hannes Tschofenig (Hannes.Tschofenig@gmx.net).
I have personally reviewed the document and I believe it is ready for
publication.

  (1.b)  Has the document had adequate review both from key WG members
          and from key non-WG members?  Does the Document Shepherd have
          any concerns about the depth or breadth of the reviews that
          have been performed?

The document was reviewed by working group members. There are no concerns
regarding the depth or breadth of the review.

Most members of the KEYPROV working group, however, do not have a lot of
expertise with ASN.1.

Fortunately, this document was created inline with PSKC and represents
the ASN.1 based encoded version of PSKC. 

  (1.c)  Does the Document Shepherd have concerns that the document
          needs more review from a particular or broader perspective,
          e.g., security, operational complexity, someone familiar with
          AAA, internationalization, or XML?

There are no concerns with this document. The document contains ASN.1
code that has been verified by tools.

  (1.d)  Does the Document Shepherd have any specific concerns or
          issues with this document that the Responsible Area Director
          and/or the IESG should be aware of?  For example, perhaps he
          or she is uncomfortable with certain parts of the document, or
          has concerns whether there really is a need for it.  In any
          event, if the WG has discussed those issues and has indicated
          that it still wishes to advance the document, detail those
          concerns here.  Has an IPR disclosure related to this document
          been filed?  If so, please include a reference to the
          disclosure and summarize the WG discussion and conclusion on
          this issue.

There are no concerns with this document. No IPR disclosures have been
field.


  (1.e)  How solid is the WG consensus behind this document?  Does it
          represent the strong concurrence of a few individuals, with
          others being silent, or does the WG as a whole understand and
          agree with it?

There is consensus in the WG behind the document.


  (1.f)  Has anyone threatened an appeal or otherwise indicated extreme
          discontent?  If so, please summarize the areas of conflict in
          separate email messages to the Responsible Area Director.  (It
          should be in a separate email because this questionnaire is
          entered into the ID Tracker.)

There is no opposition to this document.

  (1.g)  Has the Document Shepherd personally verified that the
          document satisfies all ID nits?  (See
          http://www.ietf.org/ID-Checklist.html and
          http://tools.ietf.org/tools/idnits/.)  Boilerplate checks are
          not enough; this check needs to be thorough.  Has the document
          met all formal review criteria it needs to, such as the MIB
          Doctor, media type, and URI type reviews?  If the document
          does not already indicate its intended status at the top of
          the first page, please indicate the intended status here.

The document does not contain nits.

  (1.h)  Has the document split its references into normative and
          informative?  Are there normative references to documents that
          are not ready for advancement or are otherwise in an unclear
          state?  If such normative references exist, what is the
          strategy for their completion?  Are there normative references
          that are downward references, as described in [RFC3967]?  If
          so, list these downward references to support the Area
          Director in the Last Call procedure for them [RFC3967].


The document has been split into normative and informative references.

***BEGIN DOWREF ALERT***

This document refers normatively to two informative documents
(draft-ietf-pkix-new-asn1 and draft-ietf-smime-new-asn1), one
experimental RFC (RFC 4049), and 5 "superseded" ITU/ISO standards ('02
X.680, X.681, X.682, X.683, X.690).  The references to the two
informative documents  are necessary because we're using '02 ASN.1 and
we want to import ASN.1 objects instead of copying them.  The '02 ASN.1
is used instead of the  '08 ASN.1 because that's what PKIX/SMIME use
(there are freeware compilers available).  The experimental ID reference
is necessary to  allow us to import syntax for binary time instead of
duplicating it.  Note that I believe the IETF LC message will  need to
be manually modified to indicate these these DOWNREFs.

***END DOWNREF ALERT***

             
  (1.i)  Has the Document Shepherd verified that the document's IANA
          Considerations section exists and is consistent with the body
          of the document?  If the document specifies protocol
          extensions, are reservations requested in appropriate IANA
          registries?  Are the IANA registries clearly identified?  If
          the document creates a new registry, does it define the
          proposed initial contents of the registry and an allocation
          procedure for future registrations?  Does it suggest a
          reasonable name for the new registry?  See [RFC2434].  If the
          document describes an Expert Review process, has the Document
          Shepherd conferred with the Responsible Area Director so that
          the IESG can appoint the needed Expert during IESG Evaluation?

    There are no IANA considerations.


  (1.j)  Has the Document Shepherd verified that sections of the
          document that are written in a formal language, such as XML
          code, BNF rules, MIB definitions, etc., validate correctly in
          an automated checker?

    The ASN.1 modules were compiled with dummy OID values while we
    await final assignment.

  (1.k)  The IESG approval announcement includes a Document
          Announcement Write-Up.  Please provide such a Document
          Announcement Write-Up.  Recent examples can be found in the
          "Action" announcements for approved documents.  The approval
          announcement contains the following sections:


  Technical Summary

    This document provides the ASN.1 variant of the Portable Symmetric
    Key Container (PSKC), which is defined using XML in
    draft-ietf-keyprov-pskc-05.  The symmetric key container defines
    a transport independent mechanism for one or more symmetric keys
    as well as any associated attributes.  The container by itself is
    insecure; it can be secured using either the Dynamic Symmetric Key
    Provisioning Protocol (DSKPP) [draft-ietf-keyprov-dskpp] or a CMS
    protecting content types [RFC5652].  In addition to the key
    container, this document also defines ASN.1 version of the XML
    elements and attributes defined in PSKC.

 
  Working Group Summary

    The WG agreed that this container would be the optional container,
    but there was a contingent (both in the WG and in the IEEE) that
    wanted the ASN.1 container. The format for the container has
    been stable since version -02. The ASN.1 converted XML elements
    and attributes were added in the last version to ensure alignment
    with PSKC.

  Document Quality

    The document is a product of the KEYPROV working group.

    The text of this document is derived from the XML elements and
    attributes defined in draft-ietf-keyprov-pskc. As such,
    this document represents the ASN.1 based version of the XML-based
    counterpart.
   
  Personnel

    Hannes Tschofenig is the document shepherd for this document.
2010-03-01
11 Pasi Eronen Draft Added by Pasi Eronen in state Publication Requested
2010-03-01
11 Pasi Eronen [Note]: 'Document shepherd is Hannes Tschofenig (Hannes.Tschofenig@gmx.net).' added by Pasi Eronen
2010-02-02
07 (System) New version available: draft-ietf-keyprov-symmetrickeyformat-07.txt
2009-10-20
06 (System) New version available: draft-ietf-keyprov-symmetrickeyformat-06.txt
2009-07-13
05 (System) New version available: draft-ietf-keyprov-symmetrickeyformat-05.txt
2009-01-20
04 (System) New version available: draft-ietf-keyprov-symmetrickeyformat-04.txt
2008-07-14
03 (System) New version available: draft-ietf-keyprov-symmetrickeyformat-03.txt
2008-02-26
02 (System) New version available: draft-ietf-keyprov-symmetrickeyformat-02.txt
2007-11-18
01 (System) New version available: draft-ietf-keyprov-symmetrickeyformat-01.txt
2007-09-04
00 (System) New version available: draft-ietf-keyprov-symmetrickeyformat-00.txt