Subject: [kitten] Is id-pkinit-san misnamed? Can it be reused by kca?

From: Nico Williams <[email-masked]>
Date: Thu, 5 Dec 2013 01:18:55 -0600

PKINIT (RFC4556) adds a PKIX certicate SAN (id-pkinit-san) for representing Kerberos
principal names of AS clients and servers.

I believe that id-pkinit-san does not denote "for PKINIT", and therefore
was misnamed.  It should have been named id-kerberos-san.

Presense of a id-pkinit-san in a certificate is not sufficient to grant
the subject access to the given Kerberos principal name nor to resources
that that name is authorized to access.  Additional policy is needed,
and I believe the RFC is clear about this.

I ask because I'd like RFC6717 (kerberized online CA protocol) servers
to include the client's cname and crealm in an id-pkinit-san in the
certificate to be issued.  I see no reason not to, though it is probably
important to note that the kx509 service's PKIX issuer credentials
should not be acceptable as issuers of PKINIT client certs by any KDCs
(particularly the same as the issuing kx509 service's realm's)...

...unless one *really* wants to use Kerberos->kx509->PKINIT as a form of
PKCROSS... :)

...which conveniently just happens to be my proposal for PKCROSS!

Nico
--

---

From: Nico Williams <[email-masked]>
Date: Thu, 5 Dec 2013 01:28:02 -0600

> ...which conveniently just happens to be my proposal for PKCROSS!

Sidebar:

PKINIT ASes would need to encode the certification trust path of their
clients as Kerberos transited paths.

And we'd have more pressure to support X.500-style names in transit
paths (and transit path validation policies), though at least PKINIT
ASes could insist that foreign-realm client cert issuers have
id-pkinit-sans in their issuer certs so as to avoid having to have
X.500-style names in transit paths.

---

From: Luke Howard <[email-masked]>
Date: Thu, 5 Dec 2013 18:33:07 +1100

PKU2U (draft-zhu-pku2u), BrowserID (draft-howard-gss-browserid) also use id-pkinit-san. So I don't think there is a problem using it in other specifications.

-- Luke

On 5 Dec 2013, at 6:18 pm, Nico Williams <[email-masked]> wrote:

> _______________________________________________
> Kitten mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/kitten

--
www.lukehoward.com | www.padl.com