Subject: RFC 3280 : anyPolicy in the policy mapping extension

From: Takashi ITO <[email-masked]>
Date: Tue, 29 Oct 2002 13:30:17 +0900

Hello,

I am studying certificate path validation in RFC 3280. And I have a
question about the policy mapping.

In clause 4.2.1.6, RFC 3280 says:

    Policies SHOULD NOT be mapped either to or from the special value
    anyPolicy (section 4.2.1.5).

However, Certification Path Processing in clause 6.1.4 says:

    (a)  If a policy mapping extension is present, verify that the
    special value anyPolicy does not appear as an issuerDomainPolicy
    or a subjectDomainPolicy.

The above procedure seems to mean checking the prohibition of using
anyPolicy in the policy mapping extension.

So I think that anyPolicy in this extension described in clause 4.2.1.6
should be prohibited, by replacing "SHOULD NOT" with "SHALL NOT" as the
following:

    Policies SHALL NOT be mapped either to or from the special value
    anyPolicy (section 4.2.1.5).

Is my understanding right?

Thanks,

Takashi ITO <[email-masked]>
Mitsubishi Electric Corporation

---

From: "Housley, Russ" <[email-masked]>
Date: Tue, 29 Oct 2002 10:53:39 -0500

You are reading correctly.  The algorithm prohibits mapping from 
any-policy.  The text says that one should not map to any-policy either.

Russ