Subject: Publickey Hash Realm Names

From: Sam Hartman <[email-masked]>
Date: Fri, 29 Sep 2006 17:51:26 -0400

Hi.  A month or so ago I brought up the idea of creating realm names
for non-hierarchical realms.  At that time the two proposals were
uuid-based realm names and public key hash based realm names.

Jeff Altman and a few people here said they liked the uuid approach
and proposed that uuids could be linked to certificates.

Unfortunately, everyone off-list strongly disliked the uuid approach.
In private discussions, Nico and Larry indicated they preferred public
key hash based realm names.  Nico had very strong objections to the
uuid based approach as did the vendor I'm working with.  I'll admit
that the objections to the uuid based approach all seem to be esthetic
and political.  However that matters too.

So, my question is how would people feel about standardizing an other
realm name type that had the following components;

* a prefix denoting the type
* a hash algorithm
*  The hash of  a public key associated with the realm.  If the realm supports pkinit it must sign kdc messages with this key.

As an implementer I find the public key realm name case much easier to
implement than the uuid case.  In the uuid case I need to keep an
additional mapping of uuid to public key.  In the public key case I
don't need this mapping, although I do still need the mapping from
human display name to realm name.  IT turns out though that is easier
to deal with at least in my implementation.

--Sam