Subject: CONSENSUS CALL: KDC certs part 1

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 10 Aug 2005 19:18:15 +0200

On Monday, August 01, 2005 15:53:36 +0200 Jeffrey Hutzelman <[email-masked]> 
wrote:

>>> 1) Is this cert appropriate to use as a pkinit cert
>>>
>>> 2) Does this cert refer to the KDC who I as a client want to talk to.
>>
>> Here are some possible tests for question (1):
>> (a) Correct TGS principal name in id-pksan(*)
>> (b) Presence of id-pkkdcekuoid
>> (c) Local policy
>>
>> Here are some possible tests for question (2):
>> (a) Correct TGS principal name in id-pksan
>> (b) Realm name in dnsName SAN
>> (c) Stefan's SRV RR SAN
>> (d) Realm name in CN
>> (e) Local policy

> The sense of the room was that my statement of the problem was correct,
> as was my interpretation of the language in PKINIT-26 (and now, -27).
>
> No one proposed adding any tests which are not already described in -27.
> And, no one disagreed that the 1a/2a test combination should be REQUIRED
> for clients to implement.

This means that for question 2, the only specified tests are and will 
continue to be 2a and 2e.  For question 1, test 1a is clearly permitted; 
resolution of which of tests 1b and 1c to permit in what circumstances is 
unresolved.  The REQUIRED tests are 1a and 2a.

This is a consensus call to validate the above decisions as made during the 
working group meeting.  Please comment on whether you agree or disagree 
with the above decisions.  Note that the EKU issue is still outstanding and 
will be handled separately.

-- Jeff

---

From: Sam Hartman <[email-masked]>
Date: Wed, 10 Aug 2005 14:28:31 -0400

I think it is too early for a consensus call on this issue because
likely outcomes to the local policy discussion will involve
restricting the wording of that test or adding new tests.

---

From: Brian Tung <[email-masked]>
Date: Wed, 10 Aug 2005 15:43:16 -0700

> will be handled separately.

I agree with the above decisions.

-- 
Brian Tung <[email-masked]>
USC Information Sciences Institute

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 17 Aug 2005 16:53:50 -0400

> restricting the wording of that test or adding new tests.

Perhaps, except that we don't seem to be actually _having_ any such 
discussion.  I'm about to post a followup to my last message on this topic. 
I hope it will stimulate some discussion which will allow us to resolve 
this issue and move the draft forward.

-- Jeff

---

From: Sam Hartman <[email-masked]>
Date: Wed, 17 Aug 2005 16:59:54 -0400

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> On Wednesday, August 10, 2005 02:28:31 PM -0400 Sam
    Jeffrey> Hartman
    Jeffrey> <[email-masked]> wrote:

    >> I think it is too early for a consensus call on this issue
    >> because likely outcomes to the local policy discussion will
    >> involve restricting the wording of that test or adding new
    >> tests.

    Jeffrey> Perhaps, except that we don't seem to be actually
    Jeffrey> _having_ any such discussion.  I'm about to post a
    Jeffrey> followup to my last message on this topic. I hope it will
    Jeffrey> stimulate some discussion which will allow us to resolve
    Jeffrey> this issue and move the draft forward.

OK.  I'm also still trying to get time with Russ to discuss his
constraints.