Subject: Re: pkinit, kdc certificate ?

From: Love <[email-masked]>
Date: Sun, 09 May 2004 14:23:08 +0200

Love <[email-masked]> writes:

> How does the client verify its the kdc that signed the reply and not
> someone else ?

Since noone publicly comments on this, I propose that something this this
is added:

"

If the client has external information as to the expected identity of the
KDC, the identity check MAY be omitted.

If a subjectAltName extension of type dNSName or iPAddress (if the KDC was
specifed by IP address instead of name) is part of the KDC's certificate
the client MUST check that it matches that KDC it tried to talk
to. Matching rules is specified by [RFC2459].

Client MUST check that the the KDC certificate have a extendedKeyUsage oid
id-kerberosPkinitKDC [TBD] set.

"

Love