Subject: Equivalent policies in path validation procedure

From: [email-masked]
Date: Tue, 16 Mar 1999 14:21:02 +0100 (MET)

Hello,

perhaps I am missing some obvious points, but reading the basic path
validation procedure in RFC 2459, I could not see how equivalent policies were 
used. Can someone please give me a hint? Since the new value of the acceptable 
policy set is obtained as the intersection of the old value and critically
marked policies extension, should policies (P1 in the following example)
automatically be switched with equivalent policies in this set? Or should
equivalent policies be added to the set in step (e-2)? Policies extensions 
in the example are marked critical, there are no policy constraints, and 
USER1 is trying to validate the path from MT CA to USER2. Is this a valid 
example? Also, should USER1 really know in advance all the policies that are 
equivalent to P1?

       MT CA (most trusted CA)
	 |
      P1 |
	CA1 --- CA2   (P1 equiv. to P2; CA certificate with non-critical 
	 |	 |     policy mappings extension)
      P1 |       | P2
	CA3	CA4
	 |       |
      P1 |	 | P2
       USER1   USER2

Regards, 

Tomaz