Subject: RE: Pkinit-23 comments: InitialVerifiedCAs

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 21 Feb 2005 14:12:47 -0800

Martin wrote:
> the KDC being allowed to add certificates for the path validation 
>(which the client didn't send, maybe because it didn't have them). 

The KDC is allowed to.

> In case there is a validation error with one of those certs that the 
> KDC supplied, which error is the KDC going to send?

Presumably the KDC won't use/have this invalid cert to start with.

And KDC_ERR_CANT_VERIFY_CERTIFICATE should be returned if the KDC can
not build a path.

> Btw. there seems to be a typo (missing "A") on page 5 of pkinit-25:
> TD_INVLID_CERTIFICATES

This is fixed now. Thanks.

-- Larry

-----Original Message-----
From: Martin Rex [mailto:[email-masked]] 
Sent: Monday, February 21, 2005 1:29 PM
To: Liqiang(Larry) Zhu
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: Pkinit-23 comments: InitialVerifiedCAs

Liqiang\ wrote:
> 
> The client is able to re-construct all the information Martin you are 
> asking for because the client has the invalid certificate locally. It 
> is beyond the scope of this document how the client computes the error

> message and deals with I10N implications.
> 
> No change will be made with regarding to this thread.

Am I lost again?

Where did we end up with the discussion about the KDC being allowed to
add certificates for the path validation (which the client didn't send,
maybe because it didn't have them).  In case there is a validation error
with one of those certs that the KDC supplied, which error is the KDC
going to send?

If the answer is TD_INVALID_CERTIFICATES as well, then the client will
not be able to map from the IssuerAndSerial to the Subject name, which I
would consider a real problem for error reporting.

-Martin

Btw. there seems to be a typo (missing "A") on page 5 of pkinit-25:

TD_INVLID_CERTIFICATES

---

From: Martin Rex <[email-masked]>
Date: Mon, 21 Feb 2005 23:39:20 +0100 (MET)

> Presumably the KDC won't use/have this invalid cert to start with.

Just a side note:  How come a certificate may suddenly fail signature
verification?  That may happen if there's broken CA that issues
X.509 certs which are not correct ASN.1 DER encoded, and store
it in a database in unparsed form.  After recreating the cert
from its elements according to ASN.1 DER rules, the signature
will no longer match.

Example: The GlobalSign RootCA (you'll find their incorrect DER-cert
preloaded in your nearest Browser)

-Martin