Subject: Re: Cross certificate format

From: Tom Gindin <[email-masked]>
Date: Sun, 25 Apr 2004 19:05:35 -0400

Jean-Marc:

        RFC 3280 doesn't say that anywhere.  It does say that you don't 
need to validate the trust anchor as part of the path, but it isn't clear 
from the text that a v1 certificate is acceptable as a trust anchor - and 
it certainly isn't clear that a v1 certificate is acceptable as an issuer 
if it is a trust anchor while a v3 certificate with KeyUsage= { 
DigitalSignature, keyEncipherment } is not acceptable as an issuer even if 
it is a trust anchor.
        I believe that the correct rules for versions are something like 
the following: a certificate issued by a trust anchor which is represented 
by a certificate is verifiable if the anchor certificate is either a v1 
certificate or a v3 certificate with the CA flag present in the 
basicConstraints extension.  If the anchor certificate is a v3 certificate 
with the KeyUsage extension present, it is only a valid issuer certificate 
if keyCertSign is set.

        Tom Gindin

Jean-Marc Desperrier <[email-masked]>
Sent by: [email-masked]
04/21/2004 03:42 PM

        To:     [email-masked]
        cc: 
        Subject:        Re: Cross certificate format

Tom Gindin wrote:

>        RFC 3280 does not support the use of v1 self-signed certificates, 

>which contain no extensions at all (see the text of RFC 3280's 
>basicConstraints section).  However, a number of public CA's still have 
>them.
> 
>
Applications implementing the path validation algorithm of RFC3280 MUST 
accept them when they are used as trust anchors.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 26 Apr 2004 08:51:18 -0400

Tom:

My reading of 3280 and X.509 is that a trust anchor need not even be a
certificate.  Thus, no checks need to be performed on a trust anchor at all.
You get the DN, public key, algorithm OID, and parameters (if applicable)
from a trust anchor.  Any checks are gratuitous and not required by either
standard.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Tom Gindin
Sent: Sunday, April 25, 2004 7:06 PM
To: Jean-Marc Desperrier
Cc: [email-masked]
Subject: Re: Cross certificate format

        Jean-Marc:

        Tom Gindin

        To:     [email-masked]
        cc: