Subject: [keyassure] usable certificate association?

From: "Carl Wallace" <[email-masked]>
Date: Tue, 5 Oct 2010 07:22:15 -0400

In section 3, what is a "usable certificate association"?  If the client
receives two associations but does not understand the hash algorithm in
either, does it have 0 usable associations and continue, or does it fail
with access denied because it has no match?  I assume that a different
client that receives the same two associations but does not understand
one and the other does not match should fail with access denied.

A few nits...

In the first paragraph of the Introduction, change "the trust anchor" to
"a trust anchor" and change "perform correct validation on" to
"successfully validate".

In section 2, it'd be nice to have an example that enumerates multiple
certificates to support the new text on exclusion vs. enumeration.

Also in section 3, change "it process TLS" to "it processes TLS".

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 5 Oct 2010 10:30:45 -0700

At 7:22 AM -0400 10/5/10, Carl Wallace wrote:
>In section 3, what is a "usable certificate association"? 

On that the TLS client is able to understand.

>If the client
>with access denied because it has no match?

It has 0 usable associations and continues:
   If a certificate association contains a hash type that is not
   understood by the TLS client, that certificate association MUST be
   completely ignored.

>  I assume that a different

Correct.

>"a trust anchor" and change "perform correct validation on" to

Yep.

>certificates to support the new text on exclusion vs. enumeration.

Added.

>Also in section 3, change "it process TLS" to "it processes TLS".

Done.

Thanks!

--Paul Hoffman, Director
--VPN Consortium

---

From: "Carl Wallace" <[email-masked]>
Date: Tue, 5 Oct 2010 13:34:11 -0400

>    understood by the TLS client, that certificate association MUST be

This is what I suspected was meant.  It would be more clear if the
"completely ignored" phrase was replaced with something like "marked as
unusable" to tie the two steps together.  Geoff's suggestion regarding
the hash algorithm to use could make this OBE.

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 5 Oct 2010 10:57:18 -0700

At 1:34 PM -0400 10/5/10, Carl Wallace wrote:
>unusable" to tie the two steps together. 

Good suggestion; done.

>Geoff's suggestion regarding

They work together well.

--Paul Hoffman, Director
--VPN Consortium