Subject: RE: PKINIT 20 comments (was RE: PKINIT-19 comments)

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 01 Dec 2004 12:31:52 -0500

On Tuesday, November 30, 2004 16:52:35 -0800 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> All we need here is a nametype definition, which is already in
> clarifications.
>
> The reference to the referrals draft shall be informational, and can be
> removed when needed.

The kerberos-clarifications document allocates the value 10 for 
NT-ENTERPRISE, but does not describe its form or semantics.  This is OK 
because what clarifications is really doing is providing the initial 
contents of an IANA registry, and because since nametypes are purely 
advisory, a Kerberos implementation does not need to understand their 
semantics in order to behave correctly.

The text you propose for PKINIT does not refer to the number used to 
represent the NT-ENTERPRISE nametype; it refers to the format of that 
nametype as described in referrals.  Your text adds a new form of "Kerberos 
name in the otherName field" which compliant KDC's would be required to 
support in the absence of local policy.  In order to meet this requirement, 
a KDC implementor needs to understand the format and semantics of that 
variation, which requires reading the referrals document.  This means the 
reference to referrals is normative.

If this text goes in, publication of PKINIT will be delayed until referrals 
is approved and published.

-- Jeff

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 1 Dec 2004 09:42:12 -0800

Agreed.

After chatting with Sam, we believe the best approach is to add this SAN
format specification into the referral draft. We can rely on the local
KDC policy for the certificate mapping. I should be able to send out a
new version for this farily quickly.

Thanks,

-- Larry

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: Wednesday, December 01, 2004 9:32 AM
To: Liqiang(Larry) Zhu; Sam Hartman
Cc: [email-masked]
Subject: RE: PKINIT 20 comments (was RE: PKINIT-19 comments)

On Tuesday, November 30, 2004 16:52:35 -0800 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> The reference to the referrals draft shall be informational, and can 
> be removed when needed.

The text you propose for PKINIT does not refer to the number used to
represent the NT-ENTERPRISE nametype; it refers to the format of that
nametype as described in referrals.  Your text adds a new form of
"Kerberos name in the otherName field" which compliant KDC's would be
required to support in the absence of local policy.  In order to meet
this requirement, a KDC implementor needs to understand the format and
semantics of that variation, which requires reading the referrals
document.  This means the reference to referrals is normative.

If this text goes in, publication of PKINIT will be delayed until
referrals is approved and published.

-- Jeff