Subject: draft-ietf-cat-kerberos-pk-init-33 and Windows 2003 interoperability

From: "Nebergall, Christopher" <[email-masked]>
Date: Wed, 1 Feb 2006 17:21:41 -0700

Appendix C which contains information on Microsoft PKINIT
implementations suggests several differences in certificate extensions
between draft 33 and deployed Microsoft Certificates.  Does this section
imply that a PKINIT client compliant with draft 33 which takes into
account these certificate differences will work with existing Windows
2000, and Windows 2003 KDC's?   I was under the impression that Windows
2000 and 2003 implemented draft 9 of the PKINIT standard which had not
only certificate specification differences but protocol and message
format differences as well.  Are the protocols similar enough using
client certificates using the new draft that they will work against
Windows 2000 and 2003, or has Microsoft patched or updated their PKINIT
implementation to use a newer draft version?

Thanks,
Christopher Nebergall