Subject: RE: pkinit comments: confirming kdc certificates

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 9 Feb 2005 12:50:01 -0800

I agree. -24 will reflect the sugguested adjustments.

-- Larry

-----Original Message-----
From: Martin Rex [mailto:[email-masked]] 
Sent: Wednesday, February 09, 2005 12:46 PM
To: [email-masked]
Cc: Liqiang(Larry) Zhu; Paul Leach; [email-masked];
[email-masked]; [email-masked]; [email-masked]
Subject: Re: pkinit comments: confirming kdc certificates

Trying to clarify myself:

The wording "The client MUST accept" leaves no, zero, nil room for the
client to apply its own policy.

"The client MUST perform such-and-such checks"  is still ok, but "The
client MUST accept" would prohibit a communication peers to reject the
certificate (chain) based on some local policy (not necessarily covered
by this spec, e.g. a local "blacklist" of certificates that a peer has
chosen *NOT* to trust, even though everything looks good from the PKI
perspective.

-Martin

Martin Rex wrote:
> 
> Liqiang wrote:
> > 
> >    1.  The client MUST accept the KDC's X.509 certificate if the
> 
> > 
> >    2.  The client MUST accept the KDC's X.509 certificate if that
> 
> Ouch--this sounds awful.  We are engineers, not attourneys.
> 
> I would prefer something along the lines of :
> 
>       Clients should perform such-and-such checks
> 
>       if these checks succeed, the certificate is considered a
>       valid KDC cert according to this specification.
> 
> -Martin
> 
> 
>

---

From: Chaskiel M Grundman <[email-masked]>
Date: Wed, 09 Feb 2005 16:05:10 -0500

> I agree. -24 will reflect the sugguested adjustments.

Based on what consensus?