Subject: RE: PKINIT-23 Editorial changes: section 3.2.4: Validation of KDC Reply

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 26 Jan 2005 15:43:34 -0800

Sam Hartman wrote:
> I think the case you are interested in is when the client knows the
cryptographic identity of the KDC.

Maybe we can just plainly put:

  In either case, unless the client can otherwise prove that the KDC
certificate is for the target KDC, it MUST do the following ...

-- larry

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Wednesday, January 26, 2005 3:12 PM
To: Liqiang(Larry) Zhu
Cc: [email-masked]
Subject: Re: PKINIT-23 Editorial changes: section 3.2.4: Validation of
KDC Reply

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu
<[email-masked]> writes:

    Liqiang(Larry)> The "Exception" is well hidden, and I see no
    Liqiang(Larry)> reason why the exception is not applied to the
    Liqiang(Larry)> second check.

    Liqiang(Larry)> I propose to re-arrange this to:

    Liqiang(Larry)>    In either case, unless the client has some
    Liqiang(Larry)> external information as to the identity of the
    Liqiang(Larry)> KDC, the client MUST do the following:

I support the intent of this change although I'm unsure it is editorial
in nature.

I'm a bit concerned by the wording.  Knowing that the KDC is at
10.0.06 is information about its identity.  

I think the case you are interested in is when the client knows the
cryptographic identity of the KDC.

--Sam

---

From: Sam Hartman <[email-masked]>
Date: Wed, 26 Jan 2005 19:05:43 -0500

Works for me.
>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    >> I think the case you are interested in is when the client knows
    Liqiang(Larry)> cryptographic identity of the KDC.

    Liqiang(Larry)> Maybe we can just plainly put:

    Liqiang(Larry)>   In either case, unless the client can otherwise
    Liqiang(Larry)> prove that the KDC certificate is for the target
    Liqiang(Larry)> KDC, it MUST do the following ...

    Liqiang(Larry)> -- larry

    Liqiang(Larry)> -----Original Message----- From: Sam Hartman
    Liqiang(Larry)> [mailto:[email-masked]] Sent: Wednesday,
    Liqiang(Larry)> January 26, 2005 3:12 PM To: Liqiang(Larry) Zhu
    Liqiang(Larry)> Cc: [email-masked] Subject: Re: PKINIT-23
    Liqiang(Larry)> Editorial changes: section 3.2.4: Validation of
    Liqiang(Larry)> KDC Reply

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu
    Liqiang(Larry)> <[email-masked]> writes:

    Liqiang(Larry)>     Liqiang(Larry)> The "Exception" is well
    Liqiang(Larry)> hidden, and I see no Liqiang(Larry)> reason why
    Liqiang(Larry)> the exception is not applied to the
    Liqiang(Larry)> Liqiang(Larry)> second check.

    Liqiang(Larry)>     Liqiang(Larry)> I propose to re-arrange this
    Liqiang(Larry)> to:

    Liqiang(Larry)>     Liqiang(Larry)> In either case, unless the
    Liqiang(Larry)> client has some Liqiang(Larry)> external
    Liqiang(Larry)> information as to the identity of the
    Liqiang(Larry)> Liqiang(Larry)> KDC, the client MUST do the
    Liqiang(Larry)> following:

    Liqiang(Larry)> I support the intent of this change although I'm
    Liqiang(Larry)> unsure it is editorial in nature.

    Liqiang(Larry)> I'm a bit concerned by the wording.  Knowing that
    Liqiang(Larry)> the KDC is at 10.0.06 is information about its
    Liqiang(Larry)> identity.

    Liqiang(Larry)> I think the case you are interested in is when the
    Liqiang(Larry)> client knows the cryptographic identity of the
    Liqiang(Larry)> KDC.

    Liqiang(Larry)> --Sam