Subject: [kitten] Bootstrapping PKINIT server certs with Re: SPAKE Preauth

From: Nico Williams <[email-masked]>
Date: Mon, 1 Jun 2015 14:46:38 -0500

It'd be great to be able to bootstrap PKINIT AS server certificate
issuer certs with SPAKE pre-auth.

I guess we could do this by having a pseudo-factor that the AS could
include in the challenge, bearing the realms' trusted issuer's
certificate.

A client would learn the PKINIT AS server cert "trust anchors" as
follows:

 - single-user clients can cache (e.g., in a user's home directory)
   realm certs extracted from successful SPAKE exchanges

 - multi-user clients can do the same *after* validating the issued TGTs
   (by getting a service Ticket for a service whose keys the client has,
   then decrypting that Ticket's enc-part).

Nico
--