Subject: RE: PKINIT-26 changes: identifying the kdc certificates

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 23 May 2005 13:12:11 -0700

I do not understand then. PKINIT clients only talk to the AS, why you
want TGS instead?

In any case, can you double check if the updated text (after the removal
of dNSName/IPAdress, and _kerberos._tcp, and DNS SRV othername etc)
looks good to you?
 
   In either case, the client MUST verify the signature in the
   SignedData according to [RFC3852].  The KDC's X.509 certificate MUST
   be validated according to [RFC3280].  In addition, unless the client
   can otherwise verify that the public key used to verify the KDC's
   signature is bound to the KDC of the target realm, the KDC's X.509
   certificate MUST contain a Subject Alternative Name extension
   [RFC3280] carrying an AnotherName whose type-id is id-pksan (as
   defined in Section 3.2.2) and whose value is a KRB5PrincipalName that
   matches the name of the TGS of the target realm (as defined in
   Section 7.3 of [CLAR]).

Thanks,

-- Larry

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Monday, May 23, 2005 12:57 PM
To: Liqiang(Larry) Zhu
Cc: Sam Hartman; Stefan Santesson; [email-masked]
Subject: Re: PKINIT-26 changes: identifying the kdc certificates

On Mon, May 23, 2005 at 12:53:39PM -0700, Liqiang(Larry) Zhu wrote:
> Nicolas.Williams wrote:
> > s/KDC/realm name/ or TGS name.
> 
> Did you mean AS (not TGS)?

No.

> Note that in this document, both the AS and the TGS are referred to as
> the KDC.

I think we need to be specific about the krb5 princ other name.  It has
to contain the TGS name.

> I assume we do not need text changes for this part, and the current
text
> does imply that the client can NOT fail to process the Kerberos
> otherName and reject the certificate, but the client is allowed to
> process other name formats or x.509 extensions, such as the one Stefan
> proposed, and decide to waive the requirement of this Kerberos name
> form.  

I don't think the text you sent the list prohibits the addition of new
KDC cert verification procedures.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 23 May 2005 15:15:30 -0500

> I do not understand then. PKINIT clients only talk to the AS, why you

There's no such thing as an AS name.  The KRB5PrincipalName defined in
the PKINIT I-D has a principal name and a realm name, neither being
optional, so, what to use as the name for the KDC?  The TGS name is
natural (and anyways, it's the server name used in most AS-REQs).

> of dNSName/IPAdress, and _kerberos._tcp, and DNS SRV othername etc)

I thought you proposed getting rid of the _kerberos._tcp text.

---

From: Jeffrey Altman <[email-masked]>
Date: Tue, 24 May 2005 13:22:32 -0400

Larry:

I think this text is fine as it stands provided that the working group
agrees that the purpose of this text is to provide a loophole such that
individual vendors can choose to implement their own verification
mechanisms.

Jeffrey Altman