Subject: RE: PKINIT status?

From: "Eric Rosenfeld" <[email-masked]>
Date: Mon, 1 Mar 2004 12:58:20 -0700

I'd prefer it if inclusion of the cname was required.

-Eric

Eric S. Rosenfeld
Project Director, PacketCable Security
CableLabs
858 Coal Creek Circle
Louisville, CO  80027-9750

Email: [email-masked]
Phone: 303-661-3841
Fax: 303-661-9199

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Saturday, February 28, 2004 11:33 PM
To: Brian Tung
Cc: Jeffrey Hutzelman; Eric Rosenfeld; [email-masked]
Subject: Re: PKINIT status?

>>>>> "Brian" == Brian Tung <[email-masked]> writes:

    Brian> The text above does suggest that the client may omit the
    Brian> cname from the AS-REQ; is this really right, or should we
    Brian> require the cname to be in the AS-REQ even when PKINIT is
    Brian> employed?

My preference to move the document forward faster without having to
carefully consider security considerations of AS requests without
cnames is to require the client to know the mapping.

Now is the time for people to speak up and say this breaks their
planned (or current) deployment.  As I understand Cable Labs, they'll
be OK.

---

From: Brian Tung <[email-masked]>
Date: Mon, 1 Mar 2004 12:49:19 -0800

> I'd prefer it if inclusion of the cname was required.

As I noted in response to Nico, that's the way it will be in pk-init-19.txt.

b