Subject: RE: PKINIT-22 comments

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 01 Feb 2005 12:11:09 -0500

On Monday, January 31, 2005 08:01:39 PM -0800 Paul Leach 
<[email-masked]> wrote:

> What entries? In the "open mode" you defined, there would no entries for
> clients -- just a list of trusted CA roots. That's why, if you want an
> interoperable "open mode", the spec should define the form of certs
> those CAs should issue in order to get the expected cname/crealm in the
> TGT -- because the KDC could issue TGTs based on certs issued by lots of
> CAs. (An implementation could also have side agreements with CAs and
> privately agreed upon mappings, but there needs to be a
> mandatory-to-implement one as well.)

Which it does:

   In addition to validating the client's certificate, the KDC MUST also
   check that this certificate properly maps to the client's principal
   name as specified in the AS-REQ as follows:

   1.  If the KDC has its own mapping from the name in the client's
      certificate to a Kerberos name, it uses that Kerberos name.

   2.  Otherwise, if the client's certificate contains a SubjectAltName
      extension with a Kerberos name in the otherName field, it uses
      that name.

      The otherName field (of type AnotherName) in the SubjectAltName
      extension MUST contain KRB5PrincipalName as defined below.

      The type-id field of the type AnotherName is id-pksan:

       id-pksan OBJECT IDENTIFIER ::=
         { iso(1) org(3) dod(6) internet(1) security(5) kerberosv5(2)
           x509-sanan (2) }

      The value field of the type AnotherName is the DER encoding of the
      following ASN.1 type:

       KRB5PrincipalName ::= SEQUENCE {
           realm                   [0] Realm,
           principalName           [1] PrincipalName
       }

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Sr. Research Systems Programmer
   School of Computer Science - Research Computing Facility
   Carnegie Mellon University - Pittsburgh, PA

---

From: Sam Hartman <[email-masked]>
Date: Tue, 01 Feb 2005 14:45:18 -0500

>>>>> "Paul" == Paul Leach <[email-masked]> writes:

    Paul> Out of band configuration is a reliable way to know.

I think it is a desirable property that out of band configuration not
be required in the common case.

I think we agree on this point.