Subject: RE: PKINIT-23 comments: KDC_ERR_KDC_NOT_TRUSTED

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Sun, 6 Feb 2005 20:32:11 -0800

> The client can always drop the reply if it can't validate it, but the
KDC may not want to do all that work for nothing...  
> See below.

In most common cases, the client is going to retry, and the KDC ends up
doing even more work.

> Maybe the client could tell the KDC that it has only partial knowledge
of its KDC trust anchors, so please send a reply 
> and let the client figure out if it can validate the KDC's cert.

Do we need such complexity?

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Sunday, February 06, 2005 8:24 PM
To: Liqiang(Larry) Zhu
Cc: [email-masked]
Subject: Re: PKINIT-23 comments: KDC_ERR_KDC_NOT_TRUSTED

On Sun, Feb 06, 2005 at 07:24:43PM -0800, Liqiang(Larry) Zhu wrote:
> The current text: 
> 
>    The KDC MUST return error code KDC_ERR_KDC_NOT_TRUSTED if the
client
>    did not include a kdcCert field, but did include a
trustedCertifiers
>    field, and the KDC does not possesses a certificate issued by one
of
>    the listed certifiers.
> 
> In this case, we should just ignore the trustedCertifiers and send 
> back a reply (instead of a KRB-ERROR).

The client can always drop the reply if it can't validate it, but the
KDC may not want to do all that work for nothing...  See below.

> This is because the client should be allowed to send only a partial 
> list of trusted CAs based on local policy

But, why would it do so?  No, wait, I get it.

> And the client should be allowed to use alterative means to build the 
> certification path or validate the KDC cert (say hypothetically the 
> client can obtain the KDC's public key via out-of-band mechanisms but 
> it is expensive to do so all the time).
> 
> Any comments?

Maybe the client could tell the KDC that it has only partial knowledge
of its KDC trust anchors, so please send a reply and let the client
figure out if it can validate the KDC's cert.

---

From: Nicolas Williams <[email-masked]>
Date: Sun, 6 Feb 2005 22:37:07 -0600

> In most common cases, the client is going to retry, and the KDC ends up

So, SHOULD?