Subject: PKINIT-15 comments

From: "John Brezak" <[email-masked]>
Date: Fri, 1 Feb 2002 13:12:52 -0800

A few quick PKINIT-15 comments:
 
1) Section 3.2.2 - Any number of TypedData should be allowed in the
sequence with one beint the TD-TRUSTED-CERTIFIERS TypedData. Same thing
in other cases. The KDC should be allowed to add additional TypedData to
the kerb-error, but at least one must contain the specified error code.
 
2) In this section:

	If the certificate chain can be verified, but the name of the
client in the certificate does not match the client's name in the
request, then the KDC returns an error of type
KDC_ERR_CLIENT_NAME_MISMATCH.  There is no accompanying e-data field in
this case.

there are few problems:
- the "name of the client" should specifically say the "cname" and
"crealm" and refer explicitly to an AS request.
- it should be allowed to have the KDC supply ancillary e-data (using
TypedData), but none is required for this particular error.
- what fields in the certificate must be checked for a match?

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

John Brezak                       * mailto:[email-masked]

Microsoft Corporation        ( 425-706-2602

One Microsoft Way

Redmond, WA 98052