1. March 2006IETF 65 - Dallas1 The Cryptographic Token Key Initialization Protocol (CT-KIP) Dave Mitton, RSA Security for Magnus Nyström IETF SAAG

2. March 2006IETF 65 - Dallas2 CT-KIP Primer A client-server protocol for initialization (and configuration) of cryptographic tokens with shared keys Intended for general use within computer and communications systems employing connected cryptographic tokens

3. March 2006IETF 65 - Dallas3 Objectives To provide a secure and interoperable method of initializing cryptographic tokens with secret keys To provide a solution that is easy to administer and scales well To provide a solution which does not require private-key capabilities in tokens, nor the existence of a public-key infrastructure

4. March 2006IETF 65 - Dallas4 Message flow CT-KIP server CT-KIP client Client Hello Server HelloClient NonceServer Finished(Server Trigger)

5. March 2006IETF 65 - Dallas5 Principle of Operation

6. March 2006IETF 65 - Dallas6 Current status Version 1.0 finalized in December 2005 Describes a 4-pass protocol for the initialization of cryptographic tokens with secret keys Includes a public-key variant as well as a shared-key variant Public-key variant assumes completely “blank” token (i.e. totally un-initialized)

7. March 2006IETF 65 - Dallas7 The One-Time Password Specifications (OTPS) CT-KIP was developed as one of several OTPS documents The OTPS effort was launched one year ago, to simplify the use and integration of OTP technology Analogous to the PKCS process, documents developed through an open process (no membership required)

8. March 2006IETF 65 - Dallas8 Provisioning Retrieval Validation Transport OTPS Documents Authentication Server (EAP-POTP, OTP-TLS) (OTP-WSS-Token, (OTP-Validation Service) (CT-KIP, CT-KIP-PKCS#11) (OTP-PKCS#11, OTP-CAPI)

9. March 2006IETF 65 - Dallas9 Future work A 1- and 2-pass version of CT-KIP is available in draft form from the OTPS pages Internet draft: draft-nystrom-ct-kip-00 Going forward, intent is to submit, and develop, this in IETF I-D form in parallel with the OTPS process

10. March 2006IETF 65 - Dallas10 More information Internet draft: http://www.ietf.org/internet-drafts/draft-nystrom- ct-kip-00.txtwww.ietf.org/internet-drafts/draft-nystrom- ct-kip-00.txt OTPS documents: http://www.rsasecurity.com/rsalabs/otps Mailing list (ordinary majordomo): mailto:majordomo@majordomo.rsasecurity.com Editors: mailto:otps-editor@rsasecurity.com