Subject: Re: Proposed Changes to PKINIT

From: Matthew Hur <[email-masked]>
Date: Mon, 19 Feb 2001 12:39:20 -0800

Based on the previous comments, we have responses and have made appropriate 
adjustments to the draft.  Brian Tung is making the final edits to the 
draft and he will be sending the responses to the list.

Let's get the DISA comments ASAP, so that we can move forward.

Perhaps John Brezak could comment to the list as well?

--Matt

At 02:22 PM 2/19/2001 -0600, Douglas E. Engert wrote:
>I received this e-mail and a voice mail concerning PKINIT.
>I am forwarding it on to the WG list, as we are still in
>a Working Group Final Call on PKINIT, and awaiting the authors
>responses to the other two comments on PKINIT.
>
>I would expect a more detailed comment from the DISA people in the next
>few days, (Its a federal holiday today), outlining the problems, and the
>PKINIT authors to comment.
>
>I would also expect that some of them should join the mailing list too.
>See http://www.ietf.org/html.charters/krb-wg-charter.html on how to join the
>mailing list.
>
>
>
>"Swatski, Leonard" wrote:
> >
> > Hello Doug,
> >
> > Some of DISA's folks think changes are needed to the latest PKINIT draft.
> > I don't have all the background on this, but I am wondering
> > whether it would be OK to point them to you to answer their questions
> > on the PKINIT draft?  We in DISA have not been tracking the PKINIT
> > effort, but suddenly it has become a hot item because of Kerberos
> > support in Windows 2000 and because of potential problems with
> > DoD X.509 certificates and Windows 2000.
> >
> > If you recall, you and Jim Rome visited me on 20 March 1998 in Reston VA
> > to answer my questions on DCE and Kerberos interoperability.
> >
> > The attached email contains some background, but not the whole story.
> >
> > Sincerely,
> >
> > Len Swatski
> > Defense Information Systems Agency (DISA)
> > Joint Information Engineering Organization
> > Center for Standards
> > phone: (703) 735-3233
> >
> > 
> --------------------------------------------------------------------------------------------
> >
> > Subject: PKINIT
> > Date: Fri, 16 Feb 2001 16:00:49 -0500
> > From: "Friedrichs, Paul LCDR" <[email-masked]>
> > To: "Scott, Greg" <[email-masked]>
> > CC: "Hale, Richard" <[email-masked]>, "Sam Schaen (E-mail)"
> >      <[email-masked]>, "Rick H Murphy (E-mail)" <[email-masked]>,
> >      "Samanick, John" <[email-masked]>, "Winnenberg, Thomas LCDR"
> >      <[email-masked]>, "Vickers, Randal R MAJ" 
> <[email-masked]>,
> >      "Swatski, Leonard" <[email-masked]>, "Friedrichs, Paul LCDR"
> >      <[email-masked]>
> >
> > Hi Greg,
> >
> > I hope you have free cycles to apply to a suddenly very hot challenge.
> > 
> http://search.ietf.org/internet-drafts/draft-ietf-cat-kerberos-pk-init-12.tx
> > t is close to finalization. We just spoke with Microsoft and agreed that
> > changes are needed to support static names in certs and user mobility.
> > Microsoft will prepare the details, but is afraid they won't be successful
> > in getting the changes through (because others are suspicious of 
> Microsoft).
> > Very quickly, we'll need to push this and convince others that change is
> > needed.
> >
> > Basically, it should be possible that a user's kerberos domain would not be
> > in the cert. If it isn't, the INIT server first assumes the user is in the
> > local domain. If that proves not to be true, the INIT server asks the user
> > which domain they're in.
> >
> > So, basically, please become expert on this and get ready.
> >
> > Thanks,
> >
> > Paul
>
>--
>
>  Douglas E. Engert  <[email-masked]>
>  Argonne National Laboratory
>  9700 South Cass Avenue
>  Argonne, Illinois  60439
>  (630) 252-5444

---

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 19 Feb 2001 14:22:22 -0600

"Swatski, Leonard" wrote:
>      <[email-masked]>, "Vickers, Randal R MAJ" <[email-masked]>,
> in getting the changes through (because others are suspicious of Microsoft).

--