Subject: RE: PKINIT-22 comments

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 28 Jan 2005 15:07:44 -0800

I think RFC 3280 says it is a policy issue how path is validated.

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Friday, January 28, 2005 2:50 PM
To: Liqiang(Larry) Zhu
Cc: Love; [email-masked]
Subject: Re: PKINIT-22 comments

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu
<[email-masked]> writes:

    Liqiang(Larry)> you assume that the full chain (except the root)
    Liqiang(Larry)> is all the KDC need to validate the certification
    Liqiang(Larry)> path, but let's not forgot that the algorithms for
    Liqiang(Larry)> certification path validation are completely out
    Liqiang(Larry)> side of the scope of this document.

But are specified by 3280.

    Liqiang(Larry)> Therefore I am hesitant to believe requiring the
    Liqiang(Larry)> chain solves the interoperability issue, perhaps
    Liqiang(Larry)> it hurts because MS and Heidmal clients do not
    Liqiang(Larry)> send the full chain (exclude the root).

My requirement is that the protocol we approve be interoperable.

---

From: Sam Hartman <[email-masked]>
Date: Fri, 28 Jan 2005 18:20:52 -0500

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    Liqiang(Larry)> I think RFC 3280 says it is a policy issue how
    Liqiang(Larry)> path is validated.  -----Original Message-----

I don't think so.

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 28 Jan 2005 17:22:51 -0600

Text like:

   Clients that have the certificate chain available MUST send it.

   KDCs that do not receive a full certificate chain from a client
   SHOULD build it.

might work.  Some clients wouldn't have a full certificate chain, in
which case interop will depend on KDC configuration, but I expect that
most realms' KDCs wouldn't be open to all comers but, rather, would be
open either to all clients with certificates in a particular set of PKIs
or to clients whose certificates it knows a priori (pre-shared certs).

Conversely, the case where interop breaks down with such text is where
someone wants to have an open realm that issues TGTs to any client, no
matter where, in a potentially very large PKI, a client's otherwise
valid certificate is from.

W/o PKCROSS that scenario might be more common than I'd hope though.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Sat, 29 Jan 2005 00:35:52 -0500

To clarify, what I want is for clients from any vendor to work for
KDCs from any vendor.

The document needs to answer questions like:

* must my client provide a way to configure additional certs to send?

* Is it OK for my KDC to requyire the client to send certs?

and it must answer these in such a way that any conforming client will
work with any conforming KDC.

That's all I really care about.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 31 Jan 2005 10:06:47 -0600

> * must my client provide a way to configure additional certs to send?

I think so.

> * Is it OK for my KDC to requyire the client to send certs?

I think so too.  The KDC can already reject certs it can't validate.

> work with any conforming KDC.

Modulo configuration.

Nico
--