Subject: RE: Certificate's endtime and PK-INIT

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 20 Sep 2005 00:01:54 -0700

Love's wording is not accurate. KDC does not verify the ticket, the KDC just issues one.

I propose to add the following paragraph into section 3.2.3:

   In addition, the life time of the TGT returned by the KDC MUST NOT
   exceed the life time of the client's public key.

I prefer the above, because 1) it also covers the starttime/notBefore timestamps, if applicable; 2) it is more general, it covers non-X.509 certificates, and the case where the client does not sends a certificate at all.

-- Larry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Love Hörnquist Åstrand
Sent: Monday, September 19, 2005 9:28 AM
To: [email-masked]
Subject: Certificate's endtime and PK-INIT

l27.7: 

I think this text should be added as part of "3.2.2 Receipt of
Client Request" or "4. Security Considerations":

    The KDC MUST verify that the endtime of the requested ticket is
    before the end time (notAfter time) of the client certificate. The
    KDC should still issue the ticket if the certificate is valid, but
    limit the endtime to the expiration time of the certificate.

One argue that is really part of the folloing text in the security
considerations:

   PKINIT extends the cross-realm model to the public-key
   infrastructure.  Users of PKINIT must understand security policies
   and procedures appropriate to the use of Public Key Infrastructures
   [RFC3280].

But since I missed it, it might be good to add the text above.

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Tue, 20 Sep 2005 04:09:39 -0700

"Liqiang(Larry) Zhu" <[email-masked]> writes:

> I prefer the above, because 1) it also covers the starttime/notBefore
> timestamps, if applicable; 2) it is more general, it covers non-X.509
> certificates, and the case where the client does not sends a certificate
> at all.

I think you should use the language of rfc3280 to the describe the time in
the certificate and you removed the statement about that its ok to
truncate.

Love

---

From: Sam Hartman <[email-masked]>
Date: Thu, 22 Sep 2005 19:14:03 -0400

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    Liqiang(Larry)>    In addition, the life time of the TGT returned
    Liqiang(Larry)> by the KDC MUST NOT exceed the life time of the
    Liqiang(Larry)> client's public key.

This is inaccurate because it presumes pkinit is being used to obtain a TGT.