Subject: Re: 2459 question - types of issuer certificate

From: [email-masked]
Date: Fri, 13 Aug 1999 11:46:43 -0400

I think we need a more comprehensive and unambiguous set of terms for the
subclasses of CA certificates (or issuer certificates).  The three main types
are: self-signed issuer certificates, inter-domain certificates (including most
of those which were previously known as cross-certificates), and intra-domain
issuer certificates (including most hierarchical certificates).   Two of the
combinations of these three probably also need special names: all issuer
certificates which are not self-signed are "Delegated issuer" certificates or
"PKIX cross certificates", and all issuer certificates other than inter-domain
ones are "Local-domain issuer" certificates.

     The objects managed through the CCR/CCP messages, and the objects stored in
the crossCertificatePair directory attribute, are "Delegated issuer"
certificates (or "PKIX cross certificates").  The objects stored in the
caCertificate attribute are "Local-domain issuer" certificates.

     Is this a reasonable interpretation of the current specifications?  I'm
trying to avoid terms which have had inconsistent meanings over time.

          Tom Gindin

Russ Housley <[email-masked]> on 08/13/99 08:53:29 AM

To:   Robert Moskowitz <[email-masked]>
cc:   [email-masked]
Subject:  Re: 2459 question

You have the correct idea.  But, can't we keep it simple?  A
CA  certificate has a subject that can issue other
certificates.  Obviously, the CA  certificate must contain a digital
signature public key (not a key management public key).

Russ

At 02:22 PM 8/12/99 -0400, Robert Moskowitz wrote:
>At 01:12 PM 8/12/1999 -0400, Russ Housley wrote:
> >
> >If the certificate belongs to an entity that will issue certificate to
> >other entities, then the identified extensions should be included.
>
>ERGO  'CA Certificates' Includes:
>
>Root Certs (self-signed and hierarchically signed)
>Signing Certs (though not all signing certs, a VA can have a signing cert)
>Cross Certs
>
>Any others?
>
>
>Robert Moskowitz
>ICSA
>Security Interest EMail: [email-masked]

---

From: "Robert W. Shirey" <[email-masked]>
Date: Fri, 13 Aug 1999 13:30:16 -0400

>caCertificate attribute are "Local-domain issuer" certificates.

Tom,

I strongly support the establishment of unambiguous terminology. But two notes:

1. An effort is underway to correct and improve terminology in the X.509
FPDAM. We need to stay in synch with X.509, or at least not conflict with
it. I assume that the editor, Sharon Boeyen, is monitoring the pkix list
and will help keep us straight.

2. Some of us are trying codify and improve the security terminology in use
in RFCs and Internet-Drafts. If you have not already looked at
<draft-shirey-security-glossary-00.txt>, you might want to check whether
your choices of words are already used for something else, or whether there
is already a suitable term for the concept.

For example, unless I misunderstand your intent, what you call "delegated
issuer" has long been called "subordinate CA", a CA whose public-key
certificate is issued by another CA.

Regards, -Rob-

Robert W. Shirey     GTE Internetworking     Security Practice Center
Suite 1200, 1300 Seventeenth St. North, Arlington, VA  22209-3801 USA
[email-masked], Phone 703-284-4641, Reception 284-4600, Fax 284-2766