[kitten] Is id-pkinit-san misnamed? Can it be reused by kca?

[Nico Williams <[e-mail]>]

PKINIT (RFC4556) adds a PKIX certicate SAN (id-pkinit-san) for representing Kerberos
principal names of AS clients and servers.

I believe that id-pkinit-san does not denote "for PKINIT", and therefore
was misnamed.  It should have been named id-kerberos-san.

Presense of a id-pkinit-san in a certificate is not sufficient to grant
the subject access to the given Kerberos principal name nor to resources
that that name is authorized to access.  Additional policy is needed,
and I believe the RFC is clear about this.

I ask because I'd like RFC6717 (kerberized online CA protocol) servers
to include the client's cname and crealm in an id-pkinit-san in the
certificate to be issued.  I see no reason not to, though it is probably
important to note that the kx509 service's PKIX issuer credentials
should not be acceptable as issuers of PKINIT client certs by any KDCs
(particularly the same as the issuing kx509 service's realm's)...

...unless one *really* wants to use Kerberos->kx509->PKINIT as a form of
PKCROSS... :)

...which conveniently just happens to be my proposal for PKCROSS!

Nico
--