Subject: PKINIT-23 comments: KDC_ERR_KDC_NOT_TRUSTED

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Sun, 6 Feb 2005 19:24:43 -0800

The current text: 

   The KDC MUST return error code KDC_ERR_KDC_NOT_TRUSTED if the client
   did not include a kdcCert field, but did include a trustedCertifiers
   field, and the KDC does not possesses a certificate issued by one of
   the listed certifiers.

In this case, we should just ignore the trustedCertifiers and send back
a reply (instead of a KRB-ERROR). 

This is because the client should be allowed to send only a partial list
of trusted CAs based on local policy
And the client should be allowed to use alterative means to build the
certification path or validate the KDC cert (say hypothetically the
client can obtain the KDC's public key via out-of-band mechanisms but it
is expensive to do so all the time).

Any comments?

-- Larry

---

From: Nicolas Williams <[email-masked]>
Date: Sun, 6 Feb 2005 22:24:05 -0600

> a reply (instead of a KRB-ERROR). 

The client can always drop the reply if it can't validate it, but the
KDC may not want to do all that work for nothing...  See below.

> of trusted CAs based on local policy

But, why would it do so?  No, wait, I get it.

> is expensive to do so all the time).

Maybe the client could tell the KDC that it has only partial knowledge
of its KDC trust anchors, so please send a reply and let the client
figure out if it can validate the KDC's cert.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 07 Feb 2005 17:39:59 -0500

I feel uncomfortable with this change at this late time.  This is not
a strong objection.
  I'd like to see  some explicit support for the change.
--Sam

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 07 Feb 2005 20:12:50 -0500

> is expensive to do so all the time).

This is still open, and is ticket #839