Subject: PKINIT-23 comments: TD-CERTIFICATE-INDEX

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 1 Feb 2005 09:25:06 -0800

Issues:

   Version -19 changed the index into IssuerAndSerialNumber, but the
description was not changed.

   whose
   data-type is TD-CERTIFICATE-INDEX, and whose data-value is the DER
   encoding of the index into the CertificateSet field, ordered as sent
   by the client:

Proposed new text:

   If, while processing the certification path, the KDC determines that
   the signature on one of the certificates in the signedAuthPack is
   invalid, it returns an error of type KDC_ERR_INVALID_CERTIFICATE.
   The accompanying e-data for this error is a TYPED-DATA that contains
   an element whose data-type is TD_INVALID_CERTIFICATES, and whose
   data-value contains the DER encoding of the type
   TD-INVALID-CERTIFICATES:

       TD-INVALID-CERTIFICATES ::= SEQUENCE OF OCTET STRING
                   -- Each OCTET STRING contains a CMS type
                   -- IssuerAndSerialNumber encoded according to
                   -- [RFC3852].
                   -- Each IssuerAndSerialNumber indentifies a
                   -- certificate (sent by the client) with an invalid
                   -- signature.

   If more than one certificate signature is invalid, the KDC MAY send
   one TYPED-DATA element per invalid signature.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 07 Feb 2005 19:52:32 -0500

> description was not changed.

This looks editorial in nature to me.  It is now #835.

-- Jeff