Subject: RE: pkinit comments: confirming kdc certificates

From: "Paul Leach" <[email-masked]>
Date: Fri, 4 Feb 2005 10:33:58 -0800

If the realm isn't an FQDN, then it currently needs to be (and is)
mapped to a KDC's host name by some local mechanism, which must be
secure. It can therefore continue to use the mechanism of validating the
KDC host name with the KDCs cert.

So, there doesn't absolutely have to be a way to certify non-FQDN realm
names in order to add a mechanism for certifying FQDN realm names.

However, I wouldn't object if someone wanted to propose a way to do so;
I just don't know how to do it. Such a mechanism would need to be
specific to each kind of realm name.

---

From: Chaskiel M Grundman <[email-masked]>
Date: Fri, 04 Feb 2005 13:48:19 -0500

--On Friday, February 04, 2005 10:33:58 -0800 Paul Leach
<[email-masked]> wrote:

> secure.

Where is the requirement that the mapping be secure? As I said before, in
traditional kerberos, the kdc is authenticated by the client as part of the
AS exchange, so there's no need for a secure mapping.