Subject: RE: PKINIT 20 comments (was RE: PKINIT-19 comments)

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 1 Dec 2004 23:56:11 -0800

Let's just add the UPN SAN into the referrals draft.

Thanks,

-- Larry 

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: Wednesday, December 01, 2004 9:32 AM
To: Liqiang(Larry) Zhu; Sam Hartman
Cc: [email-masked]
Subject: RE: PKINIT 20 comments (was RE: PKINIT-19 comments)

On Tuesday, November 30, 2004 16:52:35 -0800 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> All we need here is a nametype definition, which is already in 
> clarifications.
>
> The reference to the referrals draft shall be informational, and can 
> be removed when needed.

The kerberos-clarifications document allocates the value 10 for
NT-ENTERPRISE, but does not describe its form or semantics.  This is OK
because what clarifications is really doing is providing the initial
contents of an IANA registry, and because since nametypes are purely
advisory, a Kerberos implementation does not need to understand their
semantics in order to behave correctly.

The text you propose for PKINIT does not refer to the number used to
represent the NT-ENTERPRISE nametype; it refers to the format of that
nametype as described in referrals.  Your text adds a new form of
"Kerberos name in the otherName field" which compliant KDC's would be
required to support in the absence of local policy.  In order to meet
this requirement, a KDC implementor needs to understand the format and
semantics of that variation, which requires reading the referrals
document.  This means the reference to referrals is normative.

If this text goes in, publication of PKINIT will be delayed until
referrals is approved and published.

-- Jeff

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 03 Dec 2004 19:01:31 -0500

> Let's just add the UPN SAN into the referrals draft.

OK.  In which case nothing needs to be done to PKINIT for this, and we can 
consider the ticket closed.

Now we just need to deal with the remaining Love issues, and we can start a 
last call on PKINIT.

-- Jeff

---

From: Love <[email-masked]>
Date: Sat, 04 Dec 2004 15:33:48 +0100

Jeffrey Hutzelman <[email-masked]> writes:

> OK.  In which case nothing needs to be done to PKINIT for this, and we
> can consider the ticket closed.
>
> Now we just need to deal with the remaining Love issues, and we can
> start a last call on PKINIT.

I'm sure there are more issues left, I just stop looking for more when I
got to 20ish issues.

If the authors passes me an updated draft, I'll happily look over it again.

Love