Subject: RE: PKINIT draft -22 and the section for "KDC Indication of PKINIT:Support"

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 7 Dec 2004 14:01:08 -0800

Nico, 

I already mentioned in the current draft that the value SHOULD be
ignored (whatever that is). But can you propose the text that I can
add/insert in section 3.3 to address your concerns?

-- Larry 

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Tuesday, December 07, 2004 1:47 PM
To: Liqiang(Larry) Zhu
Cc: [email-masked]
Subject: Re: PKINIT draft -22 and the section for "KDC Indication of
PKINIT:Support"

On Tue, Dec 07, 2004 at 01:26:46PM -0800, Liqiang(Larry) Zhu wrote:
> 
> I want to bring it to the attention to this working group that Nico's 
> text was adjusted to use existing pre-auth types. I ran the test 
> through Nico and he agreed with it.

But I objected to your text on other grounds, namely that the text you
used does not say what value to use for the OCTET STRING associated with
the PKINIT PA type in the KRB-ERROR, what KDCs MAY/SHOULD/MUST send or
what clients should do if they receive something other than that.

That must be fixed.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 7 Dec 2004 16:31:08 -0600

I think we should say that the KDC MUST send an empty string and that
clients MUST ignore non-empty strings.

If we ever make use of that octet string for something else we can
update this RFC and replace the MUST-send-empty/MUST-ignore with
something else.

It would be bad if any KDCs started sending non-empty strings in that
slot before we define what they should send (other than the empty
string) as that could prevent future use of this slot.

My proposed change then is this:

-    The padata-value for the PA-PK-AS-REQ entry in the METHOD-DATA object 
-    is an empty octet string and SHOULD be ignored otherwise.
+    KDCs MUST leave the padata-value of PA-PK-AS-REQ entry in the
+    KRB-ERROR's METHOD-DATA empty (i.e., send a zero-length OCTET
+    STRING), and clients MUST ignore this and any other value.  Future
+    extensions to this protocol may specify other data to send instead
+    of an empty OCTET STRING.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Wed, 08 Dec 2004 05:12:31 -0500

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> I think we should say that the KDC MUST send an empty
    Nicolas> string and that clients MUST ignore non-empty strings.

As an individual, I agree.

I also believe that you should be returning KDC_ERR_PREAUTH_REQUIRED
not KDC_ERR_PREAUTH_FAILED, at least in the case where no padata is
included.