Subject: Re: Unused PKINIT options (was Re: Refactoring Kerberos pre-authe ntication)

From: Nicolas Williams <[email-masked]>
Date: Thu, 11 Sep 2003 15:28:36 -0700

On Thu, Sep 11, 2003 at 03:22:22PM -0700, Medvinsky Alexander-MGI1174 wrote:
> We had a conference call a few weeks ago on the PKINIT draft and I
> recall that:
> 	1) No one on the call was using the default translation of X.500
> 	names to principal names defined by PKINIT.  Instead, different
> 	policy-based mappings were used at the KDC.
> 	2) No one was using PKINIT without digital certificates (based
> 	on public keys stored in the KDC database)
> 
> I believe Brian Tung was going to remove those options, although he
> brought up a good point that PKINIT still needs to translate
> Certificate Authority names into realm names that go into the
> transited field.

I'm not sure but we (Sun) may be interested in option 2; I'll check.

IIUC unused options need to be removed for progression from Proposed
Standard to Standard, so unused options don't really need to be removed
_now_...

Cheers,

Nico
--

---

From: Medvinsky Alexander-MGI1174 <[email-masked]>
Date: Thu, 11 Sep 2003 15:22:22 -0700

We had a conference call a few weeks ago on the PKINIT draft and I recall that:
	1) No one on the call was using the default translation of X.500 names to principal names defined by PKINIT.  Instead, different policy-based mappings were used at the KDC.
	2) No one was using PKINIT without digital certificates (based on public keys stored in the KDC database)

I believe Brian Tung was going to remove those options, although he brought up a good point that PKINIT still needs to translate Certificate Authority names into realm names that go into the transited field.

Sasha.

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]]
Sent: Thursday, September 11, 2003 3:12 PM
To: Medvinsky Alexander-MGI1174
Cc: 'Joel N. Weber II'; [email-masked]
Subject: Unused PKINIT options (was Re: Refactoring Kerberos
pre-authentication)

On Thu, Sep 11, 2003 at 03:07:33PM -0700, Medvinsky Alexander-MGI1174 wrote:
> With a relatively large number of vendors that have already
> implemented PKINIT 16, I hope that it can advance to a standards track
> RFC without any significant changes, except for removal of some
> options that no one is using.  There could be a successor to PKINIT
> that is also on standards track, similar to Kerberos extensions vs.
> clarifications.

Which PKINIT options are not currently used?

Nico
--