Subject: PKINIT questions

From: "Geoffrey Elgey" <[email-masked]>
Date: Tue, 5 Jan 1999 12:34:11 -0000

G'day,

I've just been browsing the latest PKINIT draft, and have a (probably naive)
question to ask.

In section 3.2, on how the KDC verifies the PA-PK-AS-REQ, there are two
paragraphs concerning the handling of trusted certifiers which seem very
similar to me:

"The trustedCertifiers field contains a list of certification
    authorities trusted by the client, in the case that the client does
    not possess the KDC's public key certificate.  If the KDC has no
    certificate signed by any of the trustedCertifiers, then it returns
    an error of type KDC_ERR_CERTIFICATE_MISMATCH."

and a bit later on:

"If trustedCertifiers is provided in the PA-PK-AS-REQ, the KDC
    verifies that it has a certificate issued by one of the certifiers
    trusted by the client.  If it does not have a suitable certificate,
    the KDC returns an error message of type KDC_ERR_KDC_NOT_TRUSTED to
    the client. "

Can someone please explain the difference in these two paragraphs, apart
from the error code to be returned?

Thanks,
Geoff

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Matt Hur <[email-masked]>
Date: Tue, 05 Jan 1999 08:56:41 -0500

Hi Geoff,

Good catch.  We will need to reflect this change in the next revision. 

KDC_ERR_KDC_NOT_TRUSTED is used when the KDC does not possess a certificate
that is signed by a CA that the client trusts.

KDC_ERR_CERTIFICATE_MISMATCH is used is the KDC does not have a certificate
that matches the certificate serial number that the client requests.

Regards,
Matt