Re: [kitten] Is id-pkinit-san misnamed? Can it be reused by kca?

[Jeffrey Altman <[e-mail]>]

On 12/5/2013 3:45 PM, Jeffrey Hutzelman wrote:
> On Thu, 2013-12-05 at 01:18 -0600, Nico Williams wrote:
>> PKINIT (RFC4556) adds a PKIX certicate SAN (id-pkinit-san) for representing Kerberos
>> principal names of AS clients and servers.
>>
>> I believe that id-pkinit-san does not denote "for PKINIT", and therefore
>> was misnamed.  It should have been named id-kerberos-san.
> 
> Indeed.  This was always intended to be the way to represent Kerberos
> principal names in certs; PKINIT was just the first thing to get there.
> 
> -- Jeff

Just for the record, the UMich kx509 KCA service uses

/*
 * krb5PrincipalName, as defined in RFC 1510 and pkinit draft
 *
 * Realm ::= GeneralString
 *
 * PrincipalName ::= SEQUENCE {
 *      name-type[0]     INTEGER,
 *      name-string[1]   SEQUENCE OF GeneralString
 * }
 *
 * KerberosName ::= SEQUENCE {
 *      realm           [0] Realm, -- as define in RFC 1510
 *      principalName   [1] PrincipalName, -- as define in RFC 1510
 * }
 *
 * krb5 OBJECT IDENTIFIER ::= {
 *      iso (1) org (3) dod (6) internet (1) security (5) kerberosv5 (2)
 * }
 *
 * krb5PrincipalName OBJECT IDENTIFIER ::= { krb5 2 }
 *
 */

This was taken from draft-ietf-cat-kerberos-pk-init-09.  It was removed
in draft-ietf-cat-kerberos-pk-init-17.

Jeffrey Altman