Subject: PK-INIT-AUTHENT flag?

From: "Henry B. Hotz" <[email-masked]>
Date: Thu, 7 Dec 2006 15:52:25 -0800

I've caught wind of a move in NASA to ask Microsoft extend the PAC to  
indicate whether a user authenticated with PK-INIT.  IMO this bit of  
info ought to be a ticket flag, parallel to the hw-authent flag.   
Seems like a spectacularly simple extension.

Is there interest in/support for such a flag?
------------------------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: Jeffrey Altman <[email-masked]>
Date: Thu, 07 Dec 2006 18:59:53 -0500

Henry B. Hotz wrote:
> info ought to be a ticket flag, parallel to the hw-authent flag.  Seems
> like a spectacularly simple extension.
> 

I would not support a specific flag for PK-INIT.  Then we will need
another new flag for the next pre-auth type that comes out that people
want to use instead.

If we are going to extend, add a generic method of specifying the
pre-auth mechanism that was used (if any)

Jeffrey Altman

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 07 Dec 2006 19:21:51 -0500

> Is there interest in/support for such a flag?

See RFC 4556 section 3.2.3.  If PKINIT is used, the KDC will include the 
AD-INITIAL-VERIFIED-CAS authorization data element.

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Chair, IETF Kerberos Working Group
   Carnegie Mellon University - Pittsburgh, PA