Subject: PKINIT -20 error code descriptions ( was OCSP, take three)

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 26 Jul 2004 01:39:11 -0700

Nicolas Williams wrote:

> If all you want is to make sure that the text leaves no doubt that
something is optional, then say so.  
> Opposing some feature out of fear that the text might not be properly
written is not really reasonable, 
> not in this forum IMO.

Now the Clarifications draft is in the hands of IESG and the following
error codes are still left without description:

   KDC_ERR_CANT_VERIFY_CERTIFICATE    70 Reserved for PKINIT
   KDC_ERR_REVOCATION_STATUS_UNKNOWN       73 Reserved for PKINIT
   KDC_ERR_REVOCATION_STATUS_UNAVAILABLE   74 Reserved for PKINIT 

I assume there will be an IANA consideration section added in PKINIT -21
that describes what these error codes mean. 

One of the above might be close to what Nico wanted here.

Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Nicolas
Williams
Sent: Thursday, July 15, 2004 10:06 PM
To: Martin Rex
Cc: [email-masked]
Subject: Re: OCSP, take three

On Fri, Jul 16, 2004 at 02:49:27AM +0200, Martin Rex wrote:
> Nicolas Williams wrote:
> > 
> > > *I* _did_ read what you wrote. 
> > >   "error code for the KDC" ... "clients can then get a fresh OCSP
> > >   response and try again"
> > 
> > With this error it fails entirely; failure does not mean that the 
> > client can't try again though.
> 
> What I'm a little afraid of is wording in the spec that suggest the 
> client to retry combined with logic that says "oh, since it's optional

> and I don't have it let's (re)try without it".  This could result in 
> the KDC getting under "friendly fire" all to easily.

If all you want is to make sure that the text leaves no doubt that
something is optional, then say so.  Opposing some feature out of fear
that the text might not be properly written is not really reasonable,
not in this forum IMO.

It's clear that re-trying with fresher creds wouldn't be a requirement,
just as re-trying plain old PA-ENC-TIMESTAMP pre-authentication today is
not a requirement (and yet many users do re-try it).

Nico
--