Subject: RE: forward & reverse elements - population

From: Santosh Chokhani <[email-masked]>
Date: Wed, 9 Sep 1998 09:08:23 -0400

Sharon:

I can agree to the following text for the two option instead.  Please
note that I have further clarified cross-certificate by tying the DN and
public keys.

I think the following texts are consistent with and further
clarifications of the two options.

I STILL AM STRONGLY IN FAVOR OF OPTION 1.

NEW PROPOSED TEXT FOR OPTION 1

The cACertificate attribute, held in a particular CA's directory entry,
shall be used to store certificates issued to this CA by CAs in the same
domain as this CA.

The forward element of the crossCertificatePair attribute, held in a
particular CA's directory entry, shall be used to store certificates
issued to this CA by CAs in other domains.  Optionally, the reverse
element of the crossCertificatePair attribute, held in a particular CA's
directory entry, may contain a subset of certificates issued by this CA
to other CAs.  When both the forward and the reverse elements are
present, issuer name in one certificate shall match the subject name in
the other and vice versa, and the subject public key in one certificate
shall be capable of verifying the digital signature on the other
certificate and vice versa.

In the case of V3 certificates, none of the above CA certificates shall
include a basicConstraints extension with the cA value set to FALSE.

The definition of domain is purely a matter of local policy.

NEW PROPOSED TEXT FOR OPTION 2

The cACertificate attribute, held in a particular CA's directory entry,
shall be used to store certificates issued to this CA by CAs in the same
domain as this CA.

The forward element of the crossCertificatePair attribute, held in a
particular CA's directory entry, shall be used to store all certificates
issued to this CA.  Optionally, the reverse element of the
crossCertificatePair attribute, held in a particular CA's directory
entry, may contain a subset of certificates issued by this CA to other
CAs.  When both the forward and the reverse elements are present, issuer
name in one certificate shall match the subject name in the other and
vice versa, and the subject public key in one certificate shall be
capable of verifying the digital signature on the other certificate and
vice versa.

In the case of V3 certificates, none of the above CA certificates shall
include a basicConstraints extension with the cA value set to FALSE.

The definition of domain is purely a matter of local policy.

> -----Original Message-----
> From:	Sharon Boeyen [SMTP:[email-masked]]
> Sent:	Tuesday, September 08, 1998 5:46 PM
> To:	[email-masked]'; 'Santosh Chokhani'
> Subject:	RE: forward & reverse elements - population
> 
> 
> 
> > ----------
> > From: 	Santosh Chokhani[SMTP:[email-masked]]
> > Sent: 	September 8, 1998 10:05 AM
> > To: 	'Sharon Boeyen'; [email-masked]'
> > Subject: 	RE: forward & reverse elements - population
> > 
> 	--stuff deleted
> > > 
> > 	[]  I agree.  I do not have problem with the following language.
> > " A certificate issued to a CA by another shall be stored either in
> the
> > caCertificate or forward component of crossCertificatePair attribute
> of
> > the subject CA.  Optionally, a subset of certificates issued by a CA
> can
> > be stored in the reverse component of crossCertificatePair attribute
> of
> > the issuing CA."
> > 
> > 	Please note that to me subset includes none, some, or all.  If
> > folks want further clarification, it is ok by me.
> > 
> Santosh, the only issue I have with this text is that (at least with
> the
> rationale behind option 2) any cert that appears in the cACertificate
> attribute of a given CA
> entry, should also appear in the crossCertificatePair attribute in the
> same
> CA entry.
>  What about deleting the reference to the cACertificate attribute from
> your
> text and proposing this as new text just for the crossCertificatePair
> attribute? 
> 
> Both Jan and David have indicated reasons to keep the "pair" together
> in the
> mutual case, so we should also consider adding the last paragraph of
> the
> text David proposed for that.  
> 
> Here's what the resulting text proposal would look like:
> 
> > " A certificate issued to a CA by another shall be stored in the
> > forward component of crossCertificatePair attribute of
> > the subject CA.  Optionally, a subset of certificates issued by a CA
> can
> > be stored in the reverse component of crossCertificatePair attribute
> of
> > the issuing CA. When both elements are present in the same value,
> the
> > value shall represent a mutual cross-certification of the two CAs. "
> > 
> If we can come to consensus on that attribute, then let's see what we
> can do
> with the cACertificate attribute text.
> 
> I agree with your view on what a subset is and I think that same
> definition
> would apply to the contents of the cACertificate attribute as a subset
> of
> the crossCertificatePair forward elements in option 2.

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 09 Sep 1998 17:44:12 -0700

Santosh,

Your new proposed text does not address my concern correctly.

For a crossCertificatePair Attribute, either the forward element only
MAY be present, or the reverse element only MAY be present, or the
reverse and the forward elements may be both present.
 
Whether it is OPTION 1, OPTION 2 or whatever OPTION, the forward element
shall not be mandated to be present in a crossCertificatePair Attribute.

Denis 

-- 
      Denis Pinkas     Bull S.A.          mailto:[email-masked]
      Rue Jean Jaures  B.P. 68            Phone : 33 - 1 30 80 34 87
      78340 Les Clayes sous Bois. FRANCE   Fax  : 33 - 1 30 80 33 21