Subject: RE: FW: scvp

From: Peter Sylvester <[email-masked]>
Date: Wed, 28 Apr 2004 19:39:08 +0200 (MEST)

link the two ... and (1) and (2) together. 

(1) ... but the syntax is ambiguous. 

You cannot parse: 

    a BOOLEAN OPTIONAL,
    b BOOLEAN OPTIONAL,

you need to add tags

    a BOOLEAN OPTIONAL, 
    b [0] BOOLEAN OPTIONAL,

> 
> 2. How about changing the isCA boolean to entityType where entityType is
> an  enumerated list. Absence means don't care.

You can play with OPTIONAL instead of DEFAULT, which actually gives
a three value possibility but it is somewhat ugly. Absense of 'Any' 
you cannot really name it 'Any' because in the 88 version this is a reserved
word. 

But my question is not how to encode "this" but what is the actual
intended meaning and maybe why this is an independant parameter
and not as part of a validation algorithm for CAs.
 
For any validation algorithm specified, I don't see why one would care
whether the first element is a CA or not? 

I could understand a need to try to recursively go up a path for a particular
validation algorithm, and then one needs to say that the cert is
not the starting point of the path but an intermediate cert.

For example, if the the ssl server validation algo is used, the first
cert must contain, common name or subjectaltname and extendedkeyusage etc.
but if one goes up in the path, nothing of that is in the cert, on the
other hand, it may be part of the trust information to indicate whether
the ac in question can be use to sign such types of end entity certs.

Thus I am puzzled about the actual intention of having this field.
Or, there is no defined combination of the meaning isCA + sslserver
validation algorithm, at least not the interesting one as defined above.   

> 
> entityType ::= ENUMERATED {
>     Any                   (0),
>     endEntity             (1),
>     certificateAuthority  (2)}

Another option was suggested by peter gutmann, use a name bitlist for all these
things. 

The pb is that I don't see a useful case for the actual
semantics (even with three options), but rather a potential need to indicate
a partial path. You need to indicate a path length. one solution is an integer
that indicates how many certificates in the path are not present, default 0 means
that you have the complete beginning according to the validation algorithm,
1 means that you must test whether pathlen in basic contraints is at least 0 or
missing. This is useful import for DPD: Give a CA cert with at least a pathlen of
1 that can be used to validate the given cert (the one of the intermediate CA).

Sorry if I an unclear here.