Subject: RE: CONSENSUS CALL: KDC certs part 1

From: "Paul Leach" <[email-masked]>
Date: Fri, 9 Sep 2005 18:19:21 -0700

Lets step back a bit.

The first order question here is whether a security considerations
section of an RFC defining how to use certificates to authenticate
AS_REQs should contain advice to an organization's PKI administrators on
at least one way that they can securely set up their organization's PKI
for that purpose.

It seems I have not been successful at stating to people's satisfaction
what those considerations should be, but I don't think that the solution
is to remove any and all such considerations.

If in fact the consensus is that we should not provide such
considerations, then I will desist (or ask the Security AD for his
opinion). 

But until then, I'm going to keep trying to take everyone's objections
into account and to provide better text.

> -----Original Message-----
> From: Stefan Santesson
> Sent: Friday, September 09, 2005 12:02 PM
> To: Paul Leach; Liqiang(Larry) Zhu; Jeffrey Hutzelman; Sam Hartman
> Cc: [email-masked]; [email-masked]
> Subject: RE: CONSENSUS CALL: KDC certs part 1
> 
> I think the text below is correct and adequate up to the point
starting
> with "This leads to the following considerations"
> 
> I think the rest could be deleted.
> I'll comment on the rest in-line,
> 
> Stefan Santesson
> Program Manager, Standards Liaison
> Windows Security
> 
>

---

From: Sam Hartman <[email-masked]>
Date: Mon, 12 Sep 2005 11:58:40 -0400

>>>>> "Paul" == Paul Leach <[email-masked]> writes:

    Paul> Lets step back a bit.  The first order question here is
    Paul> whether a security considerations section of an RFC defining
    Paul> how to use certificates to authenticate AS_REQs should
    Paul> contain advice to an organization's PKI administrators on at
    Paul> least one way that they can securely set up their
    Paul> organization's PKI for that purpose.

AS an AD, I believe that including such text is allowed.  As an
individual, I believe it to be a good idea.