Subject: RE: CONSENSUS CALL: KDC certs part 1

From: "Paul Leach" <[email-masked]>
Date: Wed, 31 Aug 2005 18:30:22 -0700

I think it should be incumbent on an RFC which defines a new name form,
for which it would be useful to have name constraints, to also define
the name constraint matching rules.

> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]]
> Sent: Wednesday, August 31, 2005 6:22 PM
> To: Jeffrey Hutzelman
> Cc: Liqiang(Larry) Zhu; Stefan Santesson; Paul Leach; Sam Hartman;
> [email-masked]; [email-masked]
> Subject: Re: CONSENSUS CALL: KDC certs part 1
> 
> On Wed, Aug 31, 2005 at 05:02:09PM -0400, Jeffrey Hutzelman wrote:
> > - Stefan's original text suggested that CA's MAY use name
constraints in
> >  the certs they issue.  As I said before, this is true whether we
say it
> >  or not.  The only reason to say it is to suggest that they actually
do
> >  so.  We can do that or not, but <wg chair hat off> since there is
not
> >  yet a name constraint form defined for KRB5PrincipalName, it seems
like
> >  a not-very-useful suggestion at this time. <wg chair hat on>
> 
> If we won't define name constraints for KRB5PrincipalName (even though
> it seems like all it would take is a sentence or two, just like
RFC3280
> does for various SANs) then I think that suggestion needs to go.

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 31 Aug 2005 22:39:25 -0500

> the name constraint matching rules.

I think that's right.  But first I'd like to know if there's any
technical reason why couldn't do it.

I think we can just say:

   The realm part of KRB5Principal name constraints is treated just like
   normal DNS name name constraints (see [RFC3280] section 4.2.1.11),
   except that realm matching is case sensitive; the principalName of a
   KRB5Principal name constraint MUST have its name-type set to
   NT-UNKNOWN and zero name-string elements (meaning that the CA may
   issue certificates with any KRB5Principal that meets the realm name
   constraint and which is not a KDC certificate), or NT-SRV-INST and
   one component, "krbtgt" (meaning that the CA may issue KDC
   certificates for any realms that match the realm name constraint).

Or we could simplify and apply name constraints only to TGS princ names.

Nico
--