Subject: RE: PKINIT-22 comments

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 28 Jan 2005 14:43:20 -0800

you assume that the full chain (except the root) is all the KDC need to
validate the certification path, but let's not forgot that the
algorithms for certification path validation are completely out side of
the scope of this document.

Therefore I am hesitant to believe requiring the chain solves the
interoperability issue, perhaps it hurts because MS and Heidmal clients
do not send the full chain (exclude the root).

-- Larry

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Friday, January 28, 2005 2:28 PM
To: Liqiang(Larry) Zhu
Cc: Love; [email-masked]
Subject: Re: PKINIT-22 comments

My concern is that the protocol needs to be sufficient that clients and
kdcs from different vendors are interoperable.  How can we do that if
some send full chains and some do not.  

--Sam

---

From: Sam Hartman <[email-masked]>
Date: Fri, 28 Jan 2005 17:49:51 -0500

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    Liqiang(Larry)> you assume that the full chain (except the root)
    Liqiang(Larry)> is all the KDC need to validate the certification
    Liqiang(Larry)> path, but let's not forgot that the algorithms for
    Liqiang(Larry)> certification path validation are completely out
    Liqiang(Larry)> side of the scope of this document.

But are specified by 3280.

    Liqiang(Larry)> Therefore I am hesitant to believe requiring the
    Liqiang(Larry)> chain solves the interoperability issue, perhaps
    Liqiang(Larry)> it hurts because MS and Heidmal clients do not
    Liqiang(Larry)> send the full chain (exclude the root).

My requirement is that the protocol we approve be interoperable.