Subject: RE: PKINIT-23 comments: KDC_ERR_CERTIFICATE_MISMATCH

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Sun, 6 Feb 2005 20:35:00 -0800

Nicolas Williams wrote:
> You have to send an error anyways.

Why so? Can the KDC send back a reply using a different signature key?

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Sunday, February 06, 2005 8:16 PM
To: Liqiang(Larry) Zhu
Cc: [email-masked]
Subject: Re: PKINIT-23 comments: KDC_ERR_CERTIFICATE_MISMATCH

On Sun, Feb 06, 2005 at 07:14:51PM -0800, Liqiang(Larry) Zhu wrote:
> The current text: 
> 
>    The KDC MUST return error code KDC_ERR_CERTIFICATE_MISMATCH if the
>    client included a kdcCert field in the PA-PK-AS-REQ and the KDC
does
>    not have the corresponding certificate.
> 
> Most likely the client will need to retry without specifying a
kdcCert. 
> 
> If this is the most common case, we should just ignore the kdcCert if 
> we do not have the public key the kdcCert field specifies and send 
> back a reply (instead of a KRB-ERROR). Any comments?

You have to send an error anyways.

---

From: Nicolas Williams <[email-masked]>
Date: Sun, 6 Feb 2005 22:36:35 -0600

> Why so? Can the KDC send back a reply using a different signature key?

With DH, you can.