Subject: Required binding method - Was RE: PKINIT-26 changes: identifying the kdc certificates

From: "Stefan Santesson" <[email-masked]>
Date: Mon, 23 May 2005 19:01:28 +0100

Nico,

I understand.

My postings had nothing to do with whether PKINIT need to have one
REQUIRED method or not. I was just assuming that the logic from draft 25
was acceptable to the group.

But it would certainly be interesting to know why you feel that one
common method must be REQUIRED. Many other security protocols allow
implementation of arbitrary trust decisions.

Say for example that this group selects checking of a Kerberos principal
name in the KDC certificate as a REQUIRED method. Say also that I have
an implementation where the host name of the KDC is known to all my
clients and the KDC has a trusted certificate which certifies that host
name but NOT the principal name. Why would conformant clients need to
reject that certificate?

What do you suggest should be the REQUIRED method?

/Stefan

> -----Original Message-----
> From: [email-masked] [mailto:owner-ietf-krb-
> [email-masked]] On Behalf Of Nicolas Williams
> Sent: den 23 maj 2005 10:27
> To: Stefan Santesson
> Cc: Liqiang(Larry) Zhu; Sam Hartman; [email-masked]
> Subject: Re: PKINIT-26 changes: identifying the kdc certificates
> 
> On Mon, May 23, 2005 at 06:22:05PM +0100, Stefan Santesson wrote:
> > Nico
> >
> > There seems to be a misunderstanding here.
> >
> > You say:
> > > There must be at least one REQUIRED, practical method.
> >
> > But Larry just explained that the previous drafts currently say:
> > "Unless the client can otherwise prove that the public key used to
> > verify the KDC's signature is bound to the target KDC"
> >
> > Which means that there is currently NO REQUIRED method.
> 
> This is one reason that PKINIT is still an Internet-Draft.  I can't
see
> how it would progress if this is not addressed.
> 
> What the I-D says at this moment has no force.
> 
> > If you want to propose a required method, then I agree that it
should
> > not be SRV RR.
> 
> We must have one REQUIRED method -- otherwise PKINIT will not
progress.
> 
> > If there is NO required method, then SRV RR need not to be mentioned
> > (just implicitly allowed).
> 
> Sure, but it would be a serious misunderstanding of IETF process to
> think that no method might be REQUIRED yet have the document progress
to
> Proposed Standard.  Not gonna happen.
> 
> Cheers,
> 
> Nico
> --
>

---

From: Sam Hartman <[email-masked]>
Date: Mon, 23 May 2005 14:58:35 -0400

>>>>> "Stefan" == Stefan Santesson <[email-masked]> writes:

    Stefan> Nico, I understand.

    Stefan> My postings had nothing to do with whether PKINIT need to
    Stefan> have one REQUIRED method or not. I was just assuming that
    Stefan> the logic from draft 25 was acceptable to the group.

You changed a MUST to a MAY in such a way that you changed the logic.

I agree with Larry that the current text is fine.

I hope the PKIX working group does not approve a version of the SRV
OtherName that would allow it to be used with an application without
some standard enabling such usage.  So I would expect some document to
explicitly mention that it can be used with pkinit.  But I agree that
if PKIX were to approve an overly broad standard, the current text
would allow it to be used.