Subject: Re: CONSENSUS CALL: KDC certs part 1

From: Sam Hartman <[email-masked]>
Date: Wed, 07 Sep 2005 09:29:17 -0400

>>>>> "Stefan" == Stefan Santesson <[email-masked]> writes:

    Stefan> This looks OK to me.  However, to be picky I would change
    Stefan> the last sentence to:

    Stefan> "In addition, name constraints [RFC 3280] may be applied
    Stefan> to constrain for which realms a CA is allowed to issue KDC
    Stefan> certificates."

Is this actually true?  I thought we decided we did not yet need a
name constraint for our SAN.

ALso, I'd like to disagree with an earlier comment you made.  It is
reasonably for us to specify minimum features that an implementation
may need to expose through its local policy.  In fact it may be
desirable for us to do so in order to guarantee that one vendors'
products can be used with another vendors' products in a single
deployment.

--Sam

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 07 Sep 2005 13:20:50 -0400

On Wednesday, September 07, 2005 09:29:17 -0400 Sam Hartman 
<[email-masked]> wrote:

> Is this actually true?

I think it's true, depending on what local policy says about naming.  For 
example, if local policy permits the use of dnsName, then name constraints 
can be used on that name form to limit what realms a CA can issue certs for.

-- Jeff

---

From: Martin Rex <[email-masked]>
Date: Thu, 15 Sep 2005 20:16:04 +0200 (MET DST)

I don't know which kind of definition you want to use for "local policy"
decisions, but as far as name constraints through certificate extensions
are concerned, this is completely different from how other IETF specs
use "local matter" and "local issue" when leaving aspects up to
individual implementations.

It has been pointed out that a name constraint in a certificate is
always critical and therefore must be verified by every (correct)
certificate path validation alorithm conforming to rfc3280.
So this makes it a normative issue and not a "local matter", since
I can not configure one client to verify this KDC cert and another
client to ignore it.

A configuration using name constraints may be a policy decision
"local" to a company, but it can never be a decision local to
a particular implementation.

A simple table which lists either CA-certs and realms or 
plain-and-simple KDC-certs and realms allow purely "local"
(policy) decisions for indiviual implementations and also
individual installations of the same implementation in
the IETF sense of "local matter" that I'm used to (primarily
from how it is used in the GSS-API spec).

-Martin