Subject: RE: ticket 839: trustedCertifiers

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 14 Mar 2005 11:39:46 -0800

Love pointed out at Minneapolis we should add a few words to indicate the trustedCertifiers field is just a hint. Here is the new text Paul and I came up with:
 
       trustedCertifiers       [1] SEQUENCE OF TrustedCA OPTIONAL,
                -- A list of CAs, trusted by the client, that can 
                -- be used to certify the KDC.
                -- Each TrustedCA identifies a CA or a CA 
                -- certificate (thereby its public key).
                -- The information contained in the 
                -- trustedCertifiers MAY be used by the KDC as hints 
                -- to guide its selection of an appropriate 
                -- certificate chain to return to the client.
 
I passed this around to Love and he agreed to the text and did not have further issue with regard to this ticket.
 
-- Larry

---

From: Sam Hartman <[email-masked]>
Date: Sat, 19 Mar 2005 20:43:07 -0500

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    Liqiang(Larry)> Love pointed out at Minneapolis we should add a
    Liqiang(Larry)> few words to indicate the trustedCertifiers field
    Liqiang(Larry)> is just a hint. Here is the new text Paul and I
    Liqiang(Larry)> came up with:

I think I disagree that this text should be a hint for a KDC that has
more than one cert.

If this text is just a hint, then interoperability is not guaranteed
in that case.  I see no good reason to relax the interoperability
guarantee.