Subject: RE: PKINIT-22 comments

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 28 Jan 2005 21:36:15 -0800

>   Clients that have the certificate chain available MUST send it.

the client may not know which one is the trust anchor for the KDC. How
the KDC selects an anchor is a policy issue.

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Friday, January 28, 2005 3:23 PM
To: Liqiang(Larry) Zhu
Cc: Sam Hartman; Love; [email-masked]
Subject: Re: PKINIT-22 comments

Text like:

   Clients that have the certificate chain available MUST send it.

   KDCs that do not receive a full certificate chain from a client
   SHOULD build it.

might work.  Some clients wouldn't have a full certificate chain, in
which case interop will depend on KDC configuration, but I expect that
most realms' KDCs wouldn't be open to all comers but, rather, would be
open either to all clients with certificates in a particular set of PKIs
or to clients whose certificates it knows a priori (pre-shared certs).

Conversely, the case where interop breaks down with such text is where
someone wants to have an open realm that issues TGTs to any client, no
matter where, in a potentially very large PKI, a client's otherwise
valid certificate is from.

W/o PKCROSS that scenario might be more common than I'd hope though.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 31 Jan 2005 10:08:55 -0600

> the KDC selects an anchor is a policy issue.

The client can always as many AS exchanges as it has certs and chains.

I.e., there's something the client can do w/o configuration, and there's
something it can do w/ configuration.

For embedded clients though configuration could be problematic, but this
can be made up for with configuration at the KDC.