Subject: authorityKeyIdentifier and subjectkeyIdentifier inplement in the real case or model

From: u8142010 <[email-masked]>
Date: Fri, 04 Jun 1999 17:59:13 +0800

Hi:
I read the X.509 V3 document and felt some confusing with
authorityKeyIdentifier and subjectKeyIdentifier.
Does authorityKeyIdentifier and subjectkeyIdentifier inplement in the
real case or model, and how to implement the flow?
If without subjectkeyIdentifier, will verification of client's certs be
confused or fail? And in what situation it happens?

Best Regards,
James L.

---

From: "Jim Schaad (Exchange)" <[email-masked]>
Date: Fri, 4 Jun 1999 11:17:11 -0700

I can really only answer this question for how Microsoft is currently doing
this, but atleast some people in Microsoft have bought into SKI/AKI very big
time.

The Microsoft Certificate Servers in Win2000 will put AKI and SKI values
into all certificates issued by default.  The Microsoft code does not appear
to match either of the RFC algorithms for computing the SKI value, but is
all internally consistent about how it does that computation.  I believe
that you can actually put an SKI value into a certificate requestion and the
server will honor it.

The chaining code used on the new Microsoft products (IE 5.0 and Win2000
atleast) is very strong into doing chaining with AKI values, to the extent
that it will ignore all Issuer/Subject chaining if the AKI extension exists
in a certificate.  I personally have yet to decide if this is the correct
behavior, but that is not one of the areas over which I have a large amount
of control.  

So,
-- AKI and SKI are implemented in the real world.
-- If a certificate has an AKI, but the corresponding SKI is missing there
may be problems in doing the chaining for some products. (I think this is a
fault in the products and they should be falling back to name chaining if no
matches are found.)
-- If both are missing then everybody falls back to the good old name
chaining code.

jim

-----Original Message-----
From: u8142010 [mailto:[email-masked]]
Sent: Friday, June 04, 1999 2:59 AM
To: [email-masked]
Subject: authorityKeyIdentifier and subjectkeyIdentifier inplement in
the real case or model

Hi:

Best Regards,
James L.

---

From: [email-masked]
Date: Sat, 5 Jun 1999 08:34:50 +0800

What attributes of  athorityKeyIdentifier do you put, keyIdentifier,  or
authorityCertIssuer and authorityCertSerialNumber?
In the end user's certificates, does subjectKeyIndetifier have its purpose
or function to support the cert verification or trading security? In waht
situation will make the subjectKeyIdentifier useful?

Rgs,

Jame Lam.
----- Original Message -----
From: Jim Schaad (Exchange) <[email-masked]>
To: 'u8142010' <[email-masked]>; <[email-masked]>
Sent: Saturday, June 05, 1999 2:17 AM
Subject: RE: authorityKeyIdentifier and subjectkeyIdentifier inplement in
the real case or model