pkinit broken in 1.5 against heimdal-kdc 1.2

Hi,
while pkinit works fine with 1.2 client and 1.2 kdc using a 1.5 client
with the exact same set of certificates against a 1.2 kdc gives:

$ kinit -C FILE:user.pem,user.key [email protected]
2011-12-06T23:32:31 using cert: subject: UID=user,DC=example,DC=com sn: 61A80F99A986854154595138D20BC368F27686F5
2011-12-06T23:32:31 krb5_get_init_creds: loop 1
2011-12-06T23:32:31 KDC send 0 patypes
2011-12-06T23:32:31 krb5_get_init_creds: prepareing PKINIT padata (ietf)
2011-12-06T23:32:31 Trying to find service kdc for realm EXAMPLE.COM flags 2
2011-12-06T23:32:31 configuration file for realm EXAMPLE.COM found
2011-12-06T23:32:31 trying to communicate with host kdc.example.com in realm EXAMPLE.COM
2011-12-06T23:32:35 result of trying to talk to realm EXAMPLE.COM = 0
2011-12-06T23:32:35 krb5_get_init_creds: loop 2
2011-12-06T23:32:35 krb5_get_init_creds: processing input
2011-12-06T23:32:35 krb5_get_init_creds: got an error
2011-12-06T23:32:35 krb5_get_init_creds: KRB-ERROR -1765328359
2011-12-06T23:32:35 KDC send 4 patypes
2011-12-06T23:32:35 KDC send PA-DATA type: 2
2011-12-06T23:32:35 KDC send PA-DATA type: 16
2011-12-06T23:32:35 KDC send PA-DATA type: 15
2011-12-06T23:32:35 KDC send PA-DATA type: 19
2011-12-06T23:32:35 krb5_get_init_creds: prepareing PKINIT padata (ietf)
2011-12-06T23:32:35 Trying to find service kdc for realm EXAMPLE.COM flags 2
2011-12-06T23:32:35 configuration file for realm EXAMPLE.COM found
2011-12-06T23:32:35 trying to communicate with host kdc.example.com in realm EXAMPLE.COM
2011-12-06T23:32:35 result of trying to talk to realm EXAMPLE.COM = 0
2011-12-06T23:32:35 krb5_get_init_creds: loop 3
2011-12-06T23:32:35 krb5_get_init_creds: processing input
2011-12-06T23:32:35 krb5_get_init_creds: got an error
2011-12-06T23:32:35 krb5_get_init_creds: KRB-ERROR -1765328359
2011-12-06T23:32:35 KDC send 4 patypes
2011-12-06T23:32:35 KDC send PA-DATA type: 2
2011-12-06T23:32:35 KDC send PA-DATA type: 16
2011-12-06T23:32:35 KDC send PA-DATA type: 15
2011-12-06T23:32:35 KDC send PA-DATA type: 19
2011-12-06T23:32:35 krb5_get_init_creds: prepareing PKINIT padata (win2k)
kinit: krb5_get_init_creds: Already tried pkinit, looping

The server then has:

2011-12-06T22:57:28 AS-REQ [email protected] from <IP> for krbtgt/[email protected]
2011-12-06T22:57:28 Client sent patypes: PK-INIT(ietf), 132
2011-12-06T22:57:28 Looking for PKINIT pa-data -- [email protected]
2011-12-06T22:57:28 PKINIT: failed to verify signature: Failed to verify messageDigest: 569861
2011-12-06T22:57:28 PKINIT: Did not find a plugin for windc
2011-12-06T22:57:28 Failed to decode PKINIT PA-DATA -- [email protected]
2011-12-06T22:57:28 Looking for ENC-TS pa-data -- [email protected]
2011-12-06T22:57:28 No preauth found, returning PREAUTH-REQUIRED -- [email protected]
2011-12-06T22:57:28 sending 407 bytes to <IP>
2011-12-06T22:57:28 AS-REQ user@EXAMPLE>COM from <IP> for krbtgt/[email protected]
2011-12-06T22:57:28 Client sent patypes: PK-INIT(win2k), 132
2011-12-06T22:57:28 Looking for PKINIT pa-data -- user@
2011-12-06T22:57:28 PKINIT: failed to verify signature: Failed to verify sigature in CMS SignedData: 569861
2011-12-06T22:57:28 PKINIT: Did not find a plugin for windc
2011-12-06T22:57:28 Failed to decode PKINIT PA-DATA -- [email protected]
2011-12-06T22:57:28 Looking for ENC-TS pa-data -- [email protected]
2011-12-06T22:57:28 No preauth found, returning PREAUTH-REQUIRED -- [email protected]
2011-12-06T22:57:28 sending 407 bytes to <IP>

569861 is HX509_SIG_ALG_NO_SUPPORTED.

Non-pkinit auth works as expected. This is Debian's 1.5.dfsg.1-3
heimdal. Any ideas besides upgrading the KDC?

Cheers,
 -- Guido

P.S.: this is http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=651236