Subject: Re: Questions on Authority/Subject Key Identifiers

From: Karol Górski <[email-masked]>
Date: Wed, 2 Oct 2002 09:19:50 +0200

Peter,

You are correct. I did not want to imply that it is necessary to match the authority/subject key identifiers in successive certificates on a certification path. I was attempting to describe a (valid) situation where one of the fields in these extensions (keyIdentifier) is the same in two certificates yet the issuer/serial number fields do not match. 

Karol
  ----- Original Message ----- 
  From: Peter Hesse 
  To: Karol Górski ; Terry Hayes ; [email-masked] ; Russ 
  Cc: Tom Gindin ; [email-masked] 
  Sent: Friday, September 27, 2002 9:18 PM
  Subject: RE: Questions on Authority/Subject Key Identifiers

  Karol,

  I am not sure that I agree with your interpretation.  It is not clear to me that AKID/SKID must match for a path to be considered valid.  In fact, I think that it would be best for path development operations to be written flexible enough to deal with cases in which AKID/SKID do not match, no matter which form of AKID is being used.

  Here's where I'm coming from: most CA products currently available do not allow the specification of the subject key identifier of a CA that they are to cross-certify with.  For example, if A is to cross-certify B, A must ensure that the certificate A issues to B contains a subject key identifier that matches the authority key identifier in all certificates B issues.  

  Currently, when most CA products perform cross-certification, they calculate the SKID based upon the public key.  Hopefully, if the CAs are the same brand, or due to luck or configuration, they will calculate the SKID in the same fashion.  However, since there are no guarantees on how the SKID is calculated (the methods provided in RFC 2459/3280 are just common methods, not requirements) it is quite possible that this will result in a mismatch.  

  If your path development algorithm cannot handle this mismatch, you will be unable to build a path when a valid one exists.  Certainly matching AKID/SKID should take priority over those that do not, but last I checked there is nothing in the certificate path validation process for X.509, RFC 2459, or RFC 3280 that fails a path based upon a mismatched AKID/SKID.

  --Peter

  +---------------------------------------------------------------+
  | Peter Hesse                    [email-masked]     |
  | Phone: (703)934-2031         Gemini Security Solutions, Inc.  |
  | ICQ: 1942828                     www.geminisecurity.com       |
  +---------------------------------------------------------------+
  "Pay no attention to what the critics say; there has never been 
  a statue set up in honor of a critic." --Jean Sibelius