Subject: Re: I-D ACTION:draft-ietf-cat-kerberos-pk-init-20.txt

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 23 Sep 2004 19:05:50 -0400

On Thursday, July 22, 2004 19:01:01 +0200 Love <[email-masked]> wrote:

> * Encryption certificate is removed
>
> "3.2.  PKINIT Preauthentication Syntax and Use"
>
> Still contains references to this, the list of certificates are in the CMS
> part of the message, and thus unsigned.
>
> There is that issue that it might be unwise to use the same rsa-key to
> encrypt data that was used to sign data.
>
>     4.  The certificates field MUST contain at least a signature
>         verification certificate chain that the KDC can use to
>         verify the signature over the AuthPack.
>
>>>>>>
> 	Additionally, the
>         client MAY insert an encryption certificate chain, if
>         (for example) the client is not using ephemeral-ephemeral
>         Diffie-Hellman.
>>>>>>

Can you provide some clarification here?
Are you proposing that the text bracketed by >>>>>> be removed?

-- Jeff