Subject: PKINIT draft -22 and the section for "KDC Indication of PKINIT:Support"

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 7 Dec 2004 13:26:46 -0800

I want to bring it to the attention to this working group that Nico's
text was adjusted to use existing pre-auth types. I ran the test through
Nico and he agreed with it.

---------------------------------------------------------------------
   3.3  KDC Indication of PKINIT Support

   If pre-authentication is required, but was not present in the
   request, per [CLAR] an error message with the code
   KDC_ERR_PREAUTH_FAILED is returned and a METHOD-DATA object will be
   stored in the e-data field of the KRB-ERROR message to specify which
   pre-authentication mechanisms are acceptable.  The KDC can then
   indicate the support of PKINIT by including a PA-PK-AS-REQ element in
   that METHOD-DATA object.

   Otherwise if it is required by the KDC's local policy that the client
   must be pre-authenticated using the preauthentication mechanism
   specified in this document, but no PKINIT pre-authentication was
   present in the request, an error message with the code
   KDC_ERR_PREAUTH_FAILED SHOULD be returned.

   The padata-value for the PA-PK-AS-REQ entry in the METHOD-DATA object
   is an empty octet string and SHOULD be ignored otherwise.
---------------------------------------------------------------------

Also we believe all existing issues were addressed in this version,
folks who own these issues please help to verify. 

This week we are trying to get the draft ready for lastcall. We are
fairly optimistic that there will be another version coming out by the
end of this week or earlier next week.  If you have any issues, please
let us know before that.

-- Larry

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 7 Dec 2004 15:47:13 -0600

> Nico and he agreed with it.

But I objected to your text on other grounds, namely that the text you
used does not say what value to use for the OCTET STRING associated with
the PKINIT PA type in the KRB-ERROR, what KDCs MAY/SHOULD/MUST send or
what clients should do if they receive something other than that.

That must be fixed.

Nico
--