Subject: Re: [kitten] Is id-pkinit-san misnamed? Can it be reused by kca?

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 05 Dec 2013 15:45:13 -0500

On Thu, 2013-12-05 at 01:18 -0600, Nico Williams wrote:
> PKINIT (RFC4556) adds a PKIX certicate SAN (id-pkinit-san) for representing Kerberos
> principal names of AS clients and servers.
> 
> I believe that id-pkinit-san does not denote "for PKINIT", and therefore
> was misnamed.  It should have been named id-kerberos-san.

Indeed.  This was always intended to be the way to represent Kerberos
principal names in certs; PKINIT was just the first thing to get there.

-- Jeff

---

From: Nico Williams <[email-masked]>
Date: Thu, 5 Dec 2013 14:50:07 -0600

On Thu, Dec 05, 2013 at 03:45:13PM -0500, Jeffrey Hutzelman wrote:
> > PKINIT (RFC4556) adds a PKIX certicate SAN (id-pkinit-san) for
> > representing Kerberos principal names of AS clients and servers.
> > 
> > I believe that id-pkinit-san does not denote "for PKINIT", and
> > therefore was misnamed.  It should have been named id-kerberos-san.
> 

Thanks.  Should we file an erratum against RFC4556 to rename it?

Nico
--

---

From: Nico Williams <[email-masked]>
Date: Thu, 5 Dec 2013 14:58:15 -0600

> Thanks.  Should we file an erratum against RFC4556 to rename it?

Just did.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 05 Dec 2013 16:17:44 -0500

> > Thanks.  Should we file an erratum against RFC4556 to rename it?

No, that's not merely editorial; it's the name of an identifier in what
is effectively a published interface.  Even though it doesn't affect
anything on the wire, it does affect things that import the ASN.1
module, so a name change would be backward-incompatible.  I think we're
better off leaving it alone and just clarifying that it's intended use
is more general than just PKINIT.

-- Jeff

---

From: Nico Williams <[email-masked]>
Date: Thu, 5 Dec 2013 15:46:36 -0600

> is more general than just PKINIT.

OK, so I should update the erratum, or the AD can do it.

---

From: Nico Williams <[email-masked]>
Date: Thu, 5 Dec 2013 15:47:26 -0600

> is more general than just PKINIT.

Although... we can always add an alias for a type.

Nico
--

---

From: Jeffrey Altman <[email-masked]>
Date: Thu, 05 Dec 2013 19:50:20 -0500

> principal names in certs; PKINIT was just the first thing to get there.

Just for the record, the UMich kx509 KCA service uses

/*
 * krb5PrincipalName, as defined in RFC 1510 and pkinit draft
 *
 * Realm ::= GeneralString
 *
 * PrincipalName ::= SEQUENCE {
 *      name-type[0]     INTEGER,
 *      name-string[1]   SEQUENCE OF GeneralString
 * }
 *
 * KerberosName ::= SEQUENCE {
 *      realm           [0] Realm, -- as define in RFC 1510
 *      principalName   [1] PrincipalName, -- as define in RFC 1510
 * }
 *
 * krb5 OBJECT IDENTIFIER ::= {
 *      iso (1) org (3) dod (6) internet (1) security (5) kerberosv5 (2)
 * }
 *
 * krb5PrincipalName OBJECT IDENTIFIER ::= { krb5 2 }
 *
 */

This was taken from draft-ietf-cat-kerberos-pk-init-09.  It was removed
in draft-ietf-cat-kerberos-pk-init-17.

Jeffrey Altman