Subject: RE: Pkinit -23 comment: InitialVerifiedCAs *always* wrapped in AD-IF-RELEVANT

From: "Paul Leach" <[email-masked]>
Date: Sun, 6 Feb 2005 21:19:58 -0800

Why does it have to be critical?

A implementation that ignores the AD-INITIAL-VERIFIED-CAS just has a
hardcoded local policy that says it doesn't care. Since that kind of
local policy is allowed, why should it have to fail if it doesn't
understand AD-INITIAL-VERIFIED-CAS?

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 7 Feb 2005 11:30:26 -0600

> Why does it have to be critical?

For the same reason as transited.

That said, the transited field of Ticket is somewhat special in this
regard as its criticality is modified by the TRANSITED-POLICY-CHECKED
flag and, in any case, applications aren't required to treat it as
critical (clarifications says "...SHOULD check the transited field.").

The PKINIT I-D already has appropriate text allowing the KDC to use wrap
AD-INITIAL-VERIFIED-CAS in an AD-IF-RELEVANT ad container in some
circumstances:

   The KDC MAY wrap any AD-INITIAL-VERIFIED-CAS data in AD-IF-RELEVANT
   containers if the list of CAs satisfies the KDC's realm's policy
   (this corresponds to the TRANSITED-POLICY-CHECKED ticket flag).
   Furthermore, any TGS must copy such authorization data from tickets
   used in a PA-TGS-REQ of the TGS-REQ to the resulting ticket,
   including the AD-IF-RELEVANT container, if present.

So, why are we even talking about this?

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 07 Feb 2005 14:47:11 -0500

> So, why are we even talking about this?

I'm inclined to agree with this sentiment.
The question of whether and in what circumstances AD-INITIAL-VERIFIED-CAS 
should be critical was debated and resolved.  If you want to revisit this 
issue and make a change at this late date, you need a working group 
consensus to do so.

-- Jeff