Subject: Re: CONSENSUS CALL: KDC certs part 1

From: Timothy Hahn <[email-masked]>
Date: Thu, 1 Sep 2005 08:47:38 -0400

Nico,

I would encourage the workgroup to include a non-normative example of how 
to implement a "local policy".

Regards,
Tim Hahn

Internet: [email-masked]
Internal: Timothy Hahn/Durham/IBM@IBMUS
phone: 919.224.1565     tie-line: 8/687.1565
fax: 919.224.2530

Nicolas Williams <[email-masked]> 
Sent by: [email-masked]
08/31/2005 11:42 PM

To
"Liqiang(Larry) Zhu" <[email-masked]>
cc
Jeffrey Hutzelman <[email-masked]>, Paul Leach 
<[email-masked]>, Stefan Santesson <[email-masked]>, 
Sam Hartman <[email-masked]>, [email-masked], 
[email-masked]
Subject
Re: CONSENSUS CALL: KDC certs part 1

On Wed, Aug 31, 2005 at 08:28:30PM -0700, Liqiang(Larry) Zhu wrote:
> We do need to describe "a" way how to implement this policy in the
> security consideration section.

Since all such ways, short of name constrainsts or directories, pretty
much amount to "local policy" I do think that "local policy" is enough,
though we could also include a model of local policy (kinda like
RFC2401bis has an ASN.1 model of the SPD).  While the latter would be
nice I don't think we have to do it (anymore than we have to specify
name constraints matching for KRB5Principal).

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 1 Sep 2005 20:40:08 -0500

> to implement a "local policy".

Non-normative, sure.