Subject: RE: 3280 Question WRT SKID/AKID matching

From: Tim Moses <[email-masked]>
Date: Fri, 22 Aug 2003 09:08:05 -0400

Laudon - I think a little bit more care is required, since, unless the CA is
in a hierarchy, it may have more than one "inbound" certificate.  If their
SKIs are to populate the AKI of its "outbound" certificates, then they had
better all be the same.  This can happen if there is a single standard way
of calculating a SKI or the subject chooses it him/herself.

No matter, chaining SKI/AKI provides no additional benefit over chaining
public-key/signature and Subject/Issuer values.

All the best.  Tim.

-----Original Message-----
From: L Williams [mailto:[email-masked]]
Sent: Thursday, August 21, 2003 3:59 PM
To: 'Steve Hanna'
Cc: [email-masked]
Subject: RE: 3280 Question WRT SKID/AKID matching

I'll mention in passing why such a requirement would
be a bad idea. If you're a CA, you may not be able to
control the SKIDs that other CAs put in their cross
certificates for you. They may not use the same method
for calculating key identifiers that you use for your
AKID (since RFC 3280 allows several different methods).

[LW] In practicality, I'm not so sure this *is* a problem, since most CAs
generate the cross-certificates based on the CA's existing certificate.
Doing a binary copy of the existing certificate's SKI into the
cross-certificate's SKI is trivial.

-Laudon