Subject: RE: PKIX Path determination/construction/processing and AKIpointe r hanging

From: Alan Lloyd <[email-masked]>
Date: Mon, 8 Mar 1999 00:23:05 +1000

My thoughts are - is that the CA path processing theory is fine - as
theory but in operational systems - domain based validation, policy
based validation (and revocation), etc will be used - ie. there will
other  (policy based) information objects used that determine the path,
its validation process, its revocation process and provide some degree
of fault tollerance. These could be part of a CAs information model.  

It strikes me that all one needs to do - in the theoretical model of
cert path validation is to spam the OCSP server or CA as defined in the
AKI..eg. send it PDUs of 100gigs.
Not the way to go I think.

I think talking compliance to cert path processing - when it is a
theoretical model may not be too useful.

regards alan  

----------
From: Peter Williams
To: David P. Kemp; [email-masked]
Sent: 3/5/99 2:58:11 AM
Subject: Re: PKIX Path determination/construction/processing and
AKIpointer hanging

-----Original Message-----
From: David P. Kemp <[email-masked]>
To: [email-masked] <[email-masked]>
Date: Thursday, March 04, 1999 11:00 AM
Subject: Re: PKIX Path determination/construction/processing and
AKIpointer
hanging

>
>> From: "Peter Williams" <[email-masked]>
>>
>> QUESTION: If a certificate path chosen by a relying party contains at
>> least one certificate whose authority key id backpointer does
>> NOT resolve to a certificate in that path or any certificate
>> known to the relying party, can one designate otherwise normal
>> processing of  that chain as conforming to PKIX 2459?
>>
>> My answer to the question is yes. Does anyone disagree?
>
>
>If I understand the question correctly, I disagree.  Restating
>the question as I understand it:
>
>  If a certificate path chosen by a relying party is not
>  a continuous chain between the certificate being validated
>  and a certificate trusted by the relying party, can one designate
>  otherwise normal processing of that chain as conforming to RFC 2459?

David,

There have been a couple of responses. Let my query your
analysis to find out what is driving you to try to disagree with
a simple technical assertion concerning hanging backpointers
(marked critical, or otherwise):

You seem to have invented a technical term "continuous chain."

What is a "continuous chain"?

"  If a certificate path chosen by a relying party is not
  a continuous chain between the certificate being validated
  and a certificate trusted by the relying party, can one designate
  otherwise normal processing of that chain as conforming to RFC 2459?"

Does a cert path which has hanging AKI backpointers constitute
a continuous chain (all things about the chain or the RP's locally
trusted
authority
being otherwise acceptable/valid to the relying party
and 2459 descriptive formalisms)?

 >I interpret "This text assumes ..." to mean that if the assumption
>is not met, then the results are undefined, and that if the results
>are undefined, then there is no meaningful conformance.

Its fine for a relying party to define its own notion of conformance.
Indeed, it is necessary.

Peter.