Subject: validating KDC certificates

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 17 Oct 2005 02:21:56 -0700

Paul and at least another person from the list suggested that we need to
specify at least one way how to securely deploy PKINIT. Here we propose
to add an appendix describes just how this is done in windows vista.

---------------------------------------------------------------

Appendix C.  How to Securely Interoperate with Windows Vista

   Due to various constraints, CAs shipped with Windows Vista do not
   automatically issue KDC certificates with id-pksan SAN.  This section
   describes how to validate these KDC certificates.

   o  All PKINIT clients MUST verify that the issuer of the KDC
      certificate is authorized to issue KDC certificates for the target
      realm.  To accomplish this, for domain-joined machines, Windows
      Vista PKINIT clients verify that the issuer of the KDC certificate
      is present in the "NTAuth" system registry store (the NTAuth store
      is managed via the group policy mechansim for domain joined
      machines); For un-joined machines, Windows Vista PKINIT clients
      verify that the KDC certificate is path-validated to a trust
      anchor on the smartcard device itself.

   o  All PKINIT clients MUST verify that the KDC certificate is
      intended for the KDC of the target realm.  KDC certificates issued
      by Windows Vista CAs have the dNSName SAN containing only the
      domain name of the KDC and the intended purpose of these KDC
      certificates is restricted by the presence of the following two
      EKUs: id-pkkdcekuoid EKU and id-kp-serverAuth [RFC3280].  Note
      that all Microsoft Kerberos realm names are domain style realm
      names and they are strictly in upper case.  PKINIT clients can
      verify these KDC certificates as follows: the target realm name
      must match the value of the dNSName SAN in the KDC
      certificate and the id-pkkdcekuoid EKU must be present.
---------------------------------------------------------------