Subject: sone-of-2459. Certificate verification algorithm. Policy Mapping.

From: Michael Zolotarev <[email-masked]>
Date: Mon, 13 Mar 2000 12:32:45 +1100

Correct me if I'm wrong, but I believe there is a problem, or the text is
not complete:

The document says:
-----------------------
   6.1.4 Preparation for Certificate i+1

   To prepare for processing of certificate i+1, perform the following
steps for certificate i:
		...
      (b) If a policy mapping extension is present, then for each
      issuerDomainPolicy ID-P in the policy mapping extension:

         (1) If the policy_mapping variable is greater than 0, for each
         node in the valid_policy_tree of depth i where ID-P is the
         valid_policy, set expected_policy_set to the set of sub-
         jectDomainPolicy values that are specified as equivalent to
         ID-P by the policy mapping extension.
---------------------------------------------

The client, when defining the user_initial_policy_set (list of acceptable
policy OID), knows about the 'base' OIDs. So that I would define that I
accept OID_1.2.3.4, assuming that if it gets mapped into OID_X.Y.Z, it
should be transparent to me. However, as the result of the step 6.1.4.b.1
above, a node will be created in the tree, containing {Valid = OID_1.2.3.4,
Expected = OID_X.Y.Z}, correct?
Consequently, I will end up with the valid_policy_tree containing OIDs that
are NOT in my initial_policy_set.

If so, then the verification will fail, following the step (iii)(2) in the
wrap-up procedure:
---------------------------------------------------------
       (iii) If the valid_policy_tree is not NULL and the
         user_initial_policy_set is not "any-policy", calculate the
         intersection of the valid_policy_tree and the
         user_initial_policy_set as follows:

            1. Determine the set of policy nodes whose parent nodes have
            a valid_policy of "any-policy".  This is the
            valid_policy_node_set.
            2. If the valid_policy of any node in the
            valid_policy_node_set is not in the user_initial_policy_set
            and is not "any-policy", delete this node and all its chil-
            dren.
  ------------------------------------------------------

The solution here would be to define that the verification procedure must
remember all mappings, and use that stored mapping info during the wrap-up.
The text (iii)(2) might therefore become:
2. If the valid_policy of any node in the valid_policy_node_set is not in
the user_initial_policy_set, OR WAS NOT PRODUCED BY MAPPING FROM THE THE
user_initial_policy_set, and is not "any-policy", delete this node and all
its children.

And of course one extra state variable (mapping_info) would be necessary.

Michael