Subject: Section 3.2.2 of pk-init

From: Sam Hartman <[email-masked]>
Date: Wed, 01 Dec 2004 14:55:47 -0500

I think section 3.2.2 of pkinit 21 looks good as is.  I believe it
gives us enough flexibility to define mappings in the future and for
implementers to use those mappings today.

Note that in addition to defining the SubjectAltName in referrals
we'll also need to permit the name in the request to be empty.  Does
anyone see a problem with that?

--Sam

---

From: Brian Tung <[email-masked]>
Date: Wed, 1 Dec 2004 12:04:46 -0800

> anyone see a problem with that?

I think Eric might renew his objection to that.

b

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 1 Dec 2004 14:03:34 -0600

> anyone see a problem with that?

So the KDC can pick the corresponding realm name, right?  But there's no
integrity protected cname field in the KDC's reply pre-extensions; this
means that any transmission errors or attacks wouldn't be discovered
until a subsequent TGS or AP exchange is attempted.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Wed, 01 Dec 2004 15:14:39 -0500

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> So the KDC can pick the corresponding realm name, right?
    Nicolas> But there's no integrity protected cname field in the
    Nicolas> KDC's reply pre-extensions; this means that any
    Nicolas> transmission errors or attacks wouldn't be discovered
    Nicolas> until a subsequent TGS or AP exchange is attempted.

The WG has agreed to accept referrals into the extensions protocol.  I don't think we've had extensive review of referrals for clarifications.

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 1 Dec 2004 14:34:14 -0600

On Wed, Dec 01, 2004 at 03:14:39PM -0500, Sam Hartman wrote:
> The WG has agreed to accept referrals into the extensions protocol.  I
> don't think we've had extensive review of referrals for
> clarifications.

Got it.  Thanks for the reminder.  No objections.

Nico
--

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 01 Dec 2004 15:50:15 -0500

> anyone see a problem with that?

Just to be clear here...

We have already determined that, as far as PKINIT is concerned, we are 
_not_ allowing the cname in the AS-REQ to be missing or a special "blank" 
name.  If anyone is unclear on the details of this, you can refer to the 
comments on ticket #515 in RT.

However, what I think Sam is trying to point out is that in order to allow 
the KDC to do the form of client name mapping that Larry wants to 
implement, referrals will not only need to add the NT-ENTERPRISE otherName, 
it will also need to permit the client to make a request with no cname.

-- Jeff

---

From: Sam Hartman <[email-masked]>
Date: Wed, 01 Dec 2004 16:05:45 -0500

>>>>> "Brian" == Brian Tung <[email-masked]> writes:

    Brian> Sam Hartman wrote:
    >> I think section 3.2.2 of pkinit 21 looks good as is.  I believe
    >> it gives us enough flexibility to define mappings in the future
    >> and for implementers to use those mappings today.
    >> 
    >> Note that in addition to defining the SubjectAltName in
    >> referrals we'll also need to permit the name in the request to
    >> be empty.  Does anyone see a problem with that?

    Brian> I think Eric might renew his objection to that.

I mean do so in referrals, not in pk-init.

---

From: Brian Tung <[email-masked]>
Date: Wed, 1 Dec 2004 13:52:34 -0800

> I mean do so in referrals, not in pk-init.

Doggone it, I knew that.  Never mind.

Brian Tung <[email-masked]>