Subject: RE: PKINIT-26 changes: identifying the kdc certificates

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 23 May 2005 12:53:39 -0700

Nicolas.Williams wrote:
> s/KDC/realm name/ or TGS name.

Did you mean AS (not TGS)?

Note that in this document, both the AS and the TGS are referred to as
the KDC.

I assume we do not need text changes for this part, and the current text
does imply that the client can NOT fail to process the Kerberos
otherName and reject the certificate, but the client is allowed to
process other name formats or x.509 extensions, such as the one Stefan
proposed, and decide to waive the requirement of this Kerberos name
form.  

-- Larry

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Monday, May 23, 2005 12:28 PM
To: Stefan Santesson
Cc: Liqiang(Larry) Zhu; [email-masked]
Subject: Re: PKINIT-26 changes: identifying the kdc certificates

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> On Mon, May 23, 2005 at 06:22:05PM +0100, Stefan
    Nicolas> Santesson wrote:
    >> Nico
    >> 
    >> There seems to be a misunderstanding here.
    >> 
    >> You say: > There must be at least one REQUIRED, practical
    >> method.
    >> 
    >> But Larry just explained that the previous drafts currently
    >> say: "Unless the client can otherwise prove that the public key
    >> used to verify the KDC's signature is bound to the target KDC"
    >> 
    >> Which means that there is currently NO REQUIRED method.

    Nicolas> This is one reason that PKINIT is still an
    Nicolas> Internet-Draft.  I can't see how it would progress if
    Nicolas> this is not addressed.

    Nicolas> What the I-D says at this moment has no force.

    >> If you want to propose a required method, then I agree that it
    >> should not be SRV RR.

    Nicolas> We must have one REQUIRED method -- otherwise PKINIT will
    Nicolas> not progress.

By this Nico means that we must have a method that clients are
required to implement.  IT is not required to work with all certs.  I
think the current text satisfies that because a client may not be able
to determine the mapping for an arbitrary cert, so it needs to support
the kerberos OtherName.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 23 May 2005 14:57:24 -0500

> Did you mean AS (not TGS)?

No.

> Note that in this document, both the AS and the TGS are referred to as

I think we need to be specific about the krb5 princ other name.  It has
to contain the TGS name.

> proposed, and decide to waive the requirement of this Kerberos name

I don't think the text you sent the list prohibits the addition of new
KDC cert verification procedures.