Subject: RE: What's in a Name?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 14 Jul 2005 16:53:54 -0700

Then we will run into issues the subject DN is optional, then the
character set/UFT8 issue etc. 

It is easy for me to make such a change; I just want to make sure such
change is blessed by the working group and it can not delay the PKINIT
draft, that is we need to have a solid proposal first.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Jeffrey
Hutzelman
Sent: Thursday, July 14, 2005 4:45 PM
To: Liqiang(Larry) Zhu; [email-masked]
Cc: [email-masked]; Stefan Santesson; [email-masked]
Subject: RE: What's in a Name?

On Thursday, July 14, 2005 04:24:51 PM -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> Martin, you failed to mention that I asked this working group if we
> could change the existing semantic of TD-INVALID-CERTIFIFCATES to
> include certificates not sent by the client, there was no response to
my
> request.
>
> I would suggest sending such invalid certificate identifiers in a
> separate entry of the TYPED-DATA: say
> TD-INVALID-CERTIFIFCATES-NOT-SENT-BY-CLIENT. I doubt we need to
> standardize that however.

That seems sort of silly.  Given that the most likely handling of 
TD-INVALID-CERTIFIATES is to complain at the user, why not allow it to 
include certs not sent by the client, and include a Name?  I'd expect
this 
would make both KDC and client implementations simpler.

-- Jeff

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 14 Jul 2005 20:11:58 -0400

> character set/UFT8 issue etc.

We run into those issues anyway for TD-TRUSTED-CERTIFIERS and 
AD-INITIAL-VERIFIED-CAS.  Of course, we needn't say much about the 
character sets, since we're deferring to other documents on what 
certificates can or cannot contain.

> draft, that is we need to have a solid proposal first.

The proposal is that we rip out the text (in 2 places, AFAIK) saying that 
TD-INVALID-CERTIFICATES can only mention certs sent by the client, and then 
proceed with defining the type on the basis that it might refer to certs 
the client doesn't have.