Subject: Re: EKU considerations for KDC certificates

From: Sam Hartman <[email-masked]>
Date: Wed, 07 Sep 2005 09:37:08 -0400

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> OK.  Based on comments received in reply to this, and on
    Jeffrey> discussion at the WG meeting, I'm declaring consensus on
    Jeffrey> option "C".  To implement this, Larry has proposed making
    Jeffrey> the following change in section 3.2.4:

    Jeffrey> - Based on local policy, the client MAY require that the
    Jeffrey> KDC + Unless the client knows by some other means that
    Jeffrey> the KDC certificate + is intended for a Kerberos KDC, the
    Jeffrey> client MUST require that the KDC certificate contains the
    Jeffrey> EKU KeyPurposeId [RFC3280] id-pkkdcekuoid:

I think this is sufficient for the positive case although I do
individually favor calling out that no EKU is required with the SAN.

However I think we need to make it clear what we mean by no EKU is
required.  In particular, I believe clients should be required to
support the EKU and our KeyPurposeID.  If a cert has an EKU and does
not have our KeyPurposeID our clients MUST reject that cert.

--Sam as an individual

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 07 Sep 2005 13:15:21 -0400

> not have our KeyPurposeID our clients MUST reject that cert.

<chair hat off>

It means that we do not choose to require the presence of our EKU.
It is already the case that 3280 requires that if a cert has an EKU and has 
neither our KeyPurposeID nor the "any" key purpose, then the cert MUST be 
rejected.  I do not believe we can disallow this usage of "any", except 
when our KeyPurposeID is required to be present.  Nor do I believe it would 
be a good idea -- the rules surrounding "any" are designed to work around 
an issue which arises from the ability to use EKU in either of two ways. 
There is nothing special about PKINIT as an application which prevents that 
issue from arising, so IMHO it would be poor to defeat the workaround.

-- Jeff