Subject: * o + Display + History + Basics + Dates + People + Links + Jumbo * Configuration * Preferences * Approval #512: PKINIT 020 - Unauthenticated plaintext

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 29 Oct 2004 16:04:30 -0400

This is ticket #512, if that's not obfious from the subject.

Back in November, 2003, Sam wrote:

> I would appreciate help with one issue I'm running into. It seems to
> me that the pkinit reply does not actually sign anything in the KDC
> reply. Is this true? You end up getting a signed copy of the reply
> key, but not really any verification of the other parts of the
> request.
>
> It seems like we should look at what unauthenticated plaintext issues
> pkinit has. I don't think I can see any particular protocol flaws,
> but it does seem like the security considerations section needs to be
> expanded to address these issues.

We need a resolution on this issue in order to move forward with PKINIT.