Protocol Details Common Details Abstract Data Model The abstract data model follows what is specified in . Timers None. Initialization During initialization, the -compliant random-number generator for keys and nonces is initialized. Higher-Layer Triggered Events None. Message Processing Events and Sequencing Rules In addition to the required ( section 3.1.1) and recommended ([RFC4556] section 3.1.2) algorithms, PKCA supports the rc2-cbc ([RFC4556] section 3.1.4) algorithm. An implementer SHOULD specify ([RFC4556] section 3.1.2) as the default algorithm.<13> PKCA does not implement the id-pkinit-san algorithm ([RFC4556] section 3.2.2). PKCA supports PKInit freshness extensions .<14> Client The Kerberos client SHOULD send only a PA-PK-AS-REQ pre-authentication data identifier.<15><16> Kerberos clients can process either the PA-PK-AS-REP_OLD or the PA-PK-AS-REP pre-authentication data identifier in the reply, but not both.<17> For computer AS-REQ, PKCA clients SHOULD fail unless all of the following conditions are met.<18> The computer certificate contains: subjectAltName (SAN) DNSName field: <computer name>.<DNS domain name> where <computer name> matches the computer name and <DNS domain name> matches the computer’s DNS domain name. Enhance Key (EKU): id-pkinit-KPClientAuth (1.3.6.1.5.2.3.4) or TLS/SSL Client Authentication (1.3.6.1.5.5.7.3.2). The KDC certificate contains: SAN DNSName field: the DNS name of the domain EKU: (1.3.6.1.5.2.3.5)
Protocol Details Common Details Abstract Data Model The abstract data model follows what is specified in . Timers None. Initialization During initialization, the -compliant random-number generator for keys and nonces is initialized. Higher-Layer Triggered Events None. Message Processing Events and Sequencing Rules In addition to the required ( section 3.1.1) and recommended ([RFC4556] section 3.1.2) algorithms, PKCA supports the rc2-cbc ([RFC4556] section 3.1.4) algorithm. An implementer SHOULD specify ([RFC4556] section 3.1.2) as the default algorithm.<13> PKCA does not implement the id-pkinit-san algorithm ([RFC4556] section 3.2.2). PKCA supports PKInit freshness extensions .<14> Client The Kerberos client SHOULD send only a PA-PK-AS-REQ pre-authentication data identifier.<15><16> Kerberos clients can process either the PA-PK-AS-REP_OLD or the PA-PK-AS-REP pre-authentication data identifier in the reply, but not both.<17> For computer AS-REQ, PKCA clients SHOULD fail unless all of the following conditions are met.<18> The computer certificate contains: subjectAltName (SAN) DNSName field: <computer name>.<DNS domain name> where <computer name> matches the computer name and <DNS domain name> matches the computer’s DNS domain name. Enhance Key (EKU): id-pkinit-KPClientAuth (1.3.6.1.5.2.3.4) or TLS/SSL Client Authentication (1.3.6.1.5.5.7.3.2). The KDC certificate contains: SAN DNSName field: the DNS name of the domain EKU: (1.3.6.1.5.2.3.5)
%5BMS-PKCA%5D-150630.docx