Subject: PKINIT-24: Path validation proposal

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Sun, 6 Feb 2005 20:26:33 -0800

In the interest of moving the draft forward, I propose:

A) The client's certificate MUST pass the KDC's path validation if the
client sends all the certificates on a certification path to a trust
anchor acceptable by the KDC.

B)  The KDC's certificate MUST pass the client's path validation if the
KDC sends all the certificates on a certification path to a trust anchor
acceptable by the client.

If we can settle with this, I will add these into draft -24. thanks,

-- Larry

---

From: Nicolas Williams <[email-masked]>
Date: Sun, 6 Feb 2005 22:30:24 -0600

> If we can settle with this, I will add these into draft -24. thanks,

But not that text please -- it's confusing, at least to me.

The text has to say who must do what, and note that certificates do
nothing...

---

From: Sam Hartman <[email-masked]>
Date: Mon, 07 Feb 2005 17:25:36 -0500

I agree with this proposal as far as it goes?

do you believe it meets my criteria for interoperable implementations?
If so, what is the mandatory configuration and what in your proposal
mandates it?

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 07 Feb 2005 21:03:21 -0500

> If we can settle with this, I will add these into draft -24. thanks,

This is ticket #842.

-- Jeff