Subject: RE: New CONSENSUS CALL - KDC cert naming

From: "Paul Leach" <[email-masked]>
Date: Wed, 31 Aug 2005 17:48:51 -0700

I need more context, I'm afraid. What are 2a and 2e? From a previous
last call, or some section of the document?

> -----Original Message-----
> From: Jeffrey Hutzelman
> Sent: Wednesday, August 31, 2005 2:04 PM
> To: Sam Hartman
> 
> 
> On Monday, August 29, 2005 08:04:21 PM -0400 Jeffrey Hutzelman
> <[email-masked]> wrote:
> 
> > I believe the following are true:
> >
> > - The sense of the WG is that tests 2a (id-pksan) and 2e (local
policy)
> are
> >   sufficient, and that PKINIT not need explicitly specify any other
> tests
> >   of the KDC's identity.
> >
> > - The sense of the WG is that support for test 2a (id-pksan) should
be
> >   REQUIRED, such that all clients will support certificates which
use
> >   this name type to identify a KDC.
> >
> > I would like comments from members of the working group indicating
> > whether they agree with these two statements.
> 
> And yet, all I hear is a deafening silence.  Anyone???

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 31 Aug 2005 21:29:27 -0400

> last call, or some section of the document?

Sorry; I must have chopped off too much of the earlier message.

Test 2a is "if the certificate has a KRB5PrincipalName SAN naming the 
principal krbtgt/[email-masked], then it is for the target realm".

Test 2e is "if local policy says it's for the target realm, then it is".

These are ways to answer the question of whether the certificate belongs to 
the KDC's of a particular target realm, as separate from the question of 
whether the certificate is suitable for use by a PKINIT KDC.