Subject: AuthorityKeyIdentifier in RFC2459

From: Juergen Brauckmann <[email-masked]>
Date: Tue, 29 Jun 1999 14:12:55 +0200

Hi.

The Authority Key Identifier section in RFC2459 is:

4.2.1.1  Authority Key Identifier

   The authority key identifier extension provides a means of
   identifying the public key corresponding to the private key used to
   sign a certificate. This extension is used where an issuer has
   multiple signing keys (either due to multiple concurrent key pairs or
   due to changeover).  The identification may be based on either the
   key identifier (the subject key identifier in the issuer's
   certificate) or on the issuer name and serial number.

I feel that the last sentence is confusing, since it sounds as if you may
include the issuer name of the certificate containing the AKI (=the subject
DN of the issuer certificate) together with the issuers serial number.
According to X.509 from 1997 you have to include the issuer name of the
issuer certificate of the certificate including the AKI:
"The key may be identified..., by identification of a certificate for the
key (giving certificate issuer ... and certificate serial number...) ...."

I know at least one profile profiling the pkix profile that gets it wrong;
perhaps it's worth the effort to change it in the next version of RFC2459? 

Regards,
   Juergen
-- 
Juergen Brauckmann             Tel.:  040 / 766 29 2708
TC Trust Center for Security   Fax.:  040 / 766 29 577
in Data Networks GmbH 	    mailto:[email-masked]
Am Werder 1    		    http://www.trustcenter.de	
21073 Hamburg