Subject: RE: clarification proposal -- Re: Current status of CRL validation?

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 7 Apr 2004 22:51:00 +0100

Or as RFC 3280 currently defines it in section 6, top of page 65:

  "A particular certification path may not, however, be appropriate for
   all applications.  Therefore, an application MAY augment this
   algorithm to further limit the set of valid paths. "

/Stefan

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Ed Gerck
> Sent: den 7 april 2004 11:47
> To: PKIX
> Subject: Re: clarification proposal -- Re: Current status of CRL
> validation?
> 
> 
> 
> 
> Stefan Santesson wrote:
> >
> > The basic assumption for the whole discussion seems to be very
confused:
> >
> > Snip:
> > >
> > >    "Since there may be more than one path used to validate the
> > >    same certificate, it is possible that some paths to that
> > >    certificate are valid while others are not."
> > >
> >
> > There is only 1 kind of path that can be used to validate a
certificate,
> > and that is a valid path.
> 
> Valid to a RP may not be valid to another RP. To clarify this,
> the text could say:
> 
>  Since there may be more than one path used to validate the same
>  certificate, it is possible that some paths to that certificate
>  are valid for some RPs while not valid to other RPs.
> 
> > Valid being defined as a path that pass the
> > RPs validation policy (defined at the discretion of the relying
party).
> 
> Exactly. It depends on what each RP may choose to rely upon. Different
> RPs may define "valid path" in a different way.
> 
> The RP may also receive different answers from valid paths.
> 
> > All other paths are invalid by definition. So among the valid paths
> > there is no ambiguity, since they are all valid.
> >
> > Why complicate things?
> 
> The RPs are complicated ;-)
> 
> Cheers,
> Ed Gerck

---

From: Ed Gerck <[email-masked]>
Date: Wed, 07 Apr 2004 15:58:56 -0700

>    algorithm to further limit the set of valid paths. "

That text would be clearer if "RP software" replaces "application". 
Otherwise, I agree that it does seem equivalent to:

BTW, the purpose of the clarification Note (that includes the paragraph 
above) is not to reinvent or change X.509 or related RFCs. The purpose is 
to clarify and unify EXISTING references (including WG context interpretation)
in regard to certificate revocation. There should be lots of paragraphs 
in X.509 and related RFCs that are, with analysis, equivalent to the 
Note and vice versa. The only informative aspect of the Note should be 
in terms of ambiguity resolution.

Cheers,
Ed Gerck