Subject: RE: PKINIT-23 comments: KDC_ERR_KDC_NOT_TRUSTED

From: "Paul Leach" <[email-masked]>
Date: Mon, 7 Feb 2005 23:29:13 -0800

This is similar to the previous issue. An error is a waste; sending
something that might possibly work might (probably will in many cases)
save a round trip.

> -----Original Message-----
> From: [email-masked] [mailto:owner-ietf-krb-
> [email-masked]] On Behalf Of Jeffrey Hutzelman
> Sent: Monday, February 07, 2005 5:13 PM
> To: Liqiang(Larry) Zhu; [email-masked]
> Subject: Re: PKINIT-23 comments: KDC_ERR_KDC_NOT_TRUSTED
> 
> 
> 
> On Sunday, February 06, 2005 07:24:43 PM -0800 "Liqiang(Larry) Zhu"
> <[email-masked]> wrote:
> 
> > The current text:
> >
> >    The KDC MUST return error code KDC_ERR_KDC_NOT_TRUSTED if the
client
> >    did not include a kdcCert field, but did include a
trustedCertifiers
> >    field, and the KDC does not possesses a certificate issued by one
of
> >    the listed certifiers.
> >
> > In this case, we should just ignore the trustedCertifiers and send
back
> > a reply (instead of a KRB-ERROR).
> >
> > This is because the client should be allowed to send only a partial
list
> > of trusted CAs based on local policy
> > And the client should be allowed to use alterative means to build
the
> > certification path or validate the KDC cert (say hypothetically the
> > client can obtain the KDC's public key via out-of-band mechanisms
but it
> > is expensive to do so all the time).
> >
> > Any comments?
> 
> This is still open, and is ticket #839
>