Subject: Re: Concensus Call - initial flag semantics for PKINIT

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 08 Jan 2004 19:05:46 -0500

On Tuesday, December 16, 2003 11:53:30 -0500 Jeffrey Hutzelman 
<[email-masked]> wrote:

>
> At our PKINIT status meeting last month, we discovered one issue which was
> still unclear.  Those present believed the group had reached a particular
> decision in Boulder, but we were unable to verify that.  Thus, I'm asking
> the group now to confirm that issue...
>
>
> Ihe issue in question relates to whether the initial flag is to be set in
> tickets obtained using PKINIT.  Such tickets are issued via the
> AS-REQ/AS-REP exchange, but the exchange is protected by PKINIT using the
> client's and KDC's public key pairs, rather than by using the client's
> symmetric key (which may not even exist).
>
> Our understanding of the agreement reached in Boulder was that in tickets
> obtained using PKINIT, the initial flag _is_ (MUST be) set.
>
>
> I'd like to hear any comments, supporting or opposed to this decision,
> from members of the working group.  It is now noon on Tuesday, Dec 16.
> Unless there is heated debate, I will wait 48 hours (until noon on
> Thursday, Dec 18) before making a call on this issue.

I believe I received a grand total of two comments on this issue, both in 
support of the behaviour described above.  Nico also described the 
mechanism we discussed in Boulder for including the CA path; with his 
permission, I'll forward that comment to the list.

Based on this response, and on the discussions of this issue in Boulder and 
again among several contributors in Minneapolis, I'm determining that there 
is concensus that the initial flag is REQURIED to be set in tickets issued 
via PKINIT.