Subject: RE: Making more of Key IDs (was RE: 3280 Question WRT SKID/AKID matching)

From: Stephen Kent <[email-masked]>
Date: Thu, 28 Aug 2003 21:02:36 -0400

At 15:22 -0700 8/27/03, Ryan M. Hurst wrote:
>As a point of reference CryptoAPI (and as a result Windows) performs key
>based chaining and only falls back to name based chaining if AKIs are
>not available.
>
>Ryan
>

So, you are saying that it does not conform to 3280, right?

Steve

---

From: "Ryan M. Hurst" <[email-masked]>
Date: Thu, 28 Aug 2003 19:30:14 -0700

Depends on your definition Steve :)

We have run the latest NIST conformance tests and with very few exceptions (namely things we didn't implement because it was ambiguous or not practical) we pass, I know this doesn't exactly mean we are conformant with 3280 but its the most complete test of that I am aware of :)

As for the specifics on name vs. key based chaining, the algorithm described in 3280 section 6.1 effectively through out valid chains as a policy if the name does not match.  Its basically the last check, we know the chain cryptographically validates, we know the policy intersections and are happy with them, we know and trust the issuer and despite all of this  (and a bunch of other things) it says lets throughs it out anyways.

Now if key id's are not available CryptoAPI does fall back name based chaining, and the "desired result" of throwing out chains that are OK with the exception of name matches happens as a side effect.

So in that regard yes we are not conformant but,  I am actually quite pleased with the overall "3280" conformance of the Server 2003 chaining engine, in-fact we have back-ported it for XPSP2, and 2KSP5 (the next service packs for these OS's).

Ryan M. Hurst

From: Stephen Kent
Sent: Thu 8/28/2003 6:02 PM
To: Ryan M. Hurst
Cc: Terwilliger, Ann; [email-masked]
Subject: RE: Making more of Key IDs (was RE: 3280 Question WRT SKID/AKID matching)

Steve