Subject: Concensus Call - initial flag semantics for PKINIT

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 16 Dec 2003 11:53:30 -0500 (EST)

At our PKINIT status meeting last month, we discovered one issue which was
still unclear.  Those present believed the group had reached a particular
decision in Boulder, but we were unable to verify that.  Thus, I'm asking
the group now to confirm that issue...

Ihe issue in question relates to whether the initial flag is to be set in
tickets obtained using PKINIT.  Such tickets are issued via the
AS-REQ/AS-REP exchange, but the exchange is protected by PKINIT using the
client's and KDC's public key pairs, rather than by using the client's
symmetric key (which may not even exist).

Our understanding of the agreement reached in Boulder was that in tickets
obtained using PKINIT, the initial flag _is_ (MUST be) set.

I'd like to hear any comments, supporting or opposed to this decision,
from members of the working group.  It is now noon on Tuesday, Dec 16.
Unless there is heated debate, I will wait 48 hours (until noon on
Thursday, Dec 18) before making a call on this issue.

-- Jeff