Subject: RE: PKINIT-22 comments

From: "Paul Leach" <[email-masked]>
Date: Tue, 1 Feb 2005 09:38:44 -0800

I actually see no reason to even require the leaf cert if RFC 3852
doesn't require it. If the AS-REQ contains the cname, then a KDC could
look up the entire chain based on that. (This is essentially what using
"naked" public keys on the KDC does, for example.)

Use of such a mode by the client would require that a client either have
a-priori knowledge that the KDC supported it as well, or the ability to
retry with a partial chain and eventually a full chain. A client without
a-priori knowledge or retry ability must send the complete chain.

There is also no logical requirement that a client sending a partial
chain and getting an error must retry immediately with a full chain --
only that it be able to eventually do so. It could retry with other
partial chains (which it chose based on roots the KDC has said it
supports).

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 1 Feb 2005 11:38:54 -0600

> a-priori knowledge or retry ability must send the complete chain.

We are now in violent agreement.