Re: [kitten] Is id-pkinit-san misnamed? Can it be reused by kca?

PKU2U (draft-zhu-pku2u), BrowserID (draft-howard-gss-browserid) also use id-pkinit-san. So I don't think there is a problem using it in other specifications.

-- Luke

On 5 Dec 2013, at 6:18 pm, Nico Williams <nico@cryptonector.com> wrote:

> PKINIT (RFC4556) adds a PKIX certicate SAN (id-pkinit-san) for representing Kerberos
> principal names of AS clients and servers.
> 
> I believe that id-pkinit-san does not denote "for PKINIT", and therefore
> was misnamed.  It should have been named id-kerberos-san.
> 
> Presense of a id-pkinit-san in a certificate is not sufficient to grant
> the subject access to the given Kerberos principal name nor to resources
> that that name is authorized to access.  Additional policy is needed,
> and I believe the RFC is clear about this.
> 
> I ask because I'd like RFC6717 (kerberized online CA protocol) servers
> to include the client's cname and crealm in an id-pkinit-san in the
> certificate to be issued.  I see no reason not to, though it is probably
> important to note that the kx509 service's PKIX issuer credentials
> should not be acceptable as issuers of PKINIT client certs by any KDCs
> (particularly the same as the issuing kx509 service's realm's)...
> 
> ...unless one *really* wants to use Kerberos->kx509->PKINIT as a form of
> PKCROSS... :)
> 
> ...which conveniently just happens to be my proposal for PKCROSS!
> 
> Nico
> -- 
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten

--
www.lukehoward.com | www.padl.com