Subject: RE: clarification proposal -- Re: Current status of CRL validation?

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 7 Apr 2004 16:45:56 +0100

The basic assumption for the whole discussion seems to be very confused:

Snip:
> 
>    "Since there may be more than one path used to validate the
>    same certificate, it is possible that some paths to that
>    certificate are valid while others are not."
> 

There is only 1 kind of path that can be used to validate a certificate,
and that is a valid path. Valid being defined as a path that pass the
RPs validation policy (defined at the discretion of the relying party).

All other paths are invalid by definition. So among the valid paths
there is no ambiguity, since they are all valid.

Why complicate things?

/Stefan

---

From: Ed Gerck <[email-masked]>
Date: Wed, 07 Apr 2004 11:47:09 -0700

Stefan Santesson wrote:
> and that is a valid path. 

Valid to a RP may not be valid to another RP. To clarify this,
the text could say:

 Since there may be more than one path used to validate the same 
 certificate, it is possible that some paths to that certificate 
 are valid for some RPs while not valid to other RPs. 

> Valid being defined as a path that pass the

Exactly. It depends on what each RP may choose to rely upon. Different
RPs may define "valid path" in a different way.

The RP may also receive different answers from valid paths.

> there is no ambiguity, since they are all valid.

The RPs are complicated ;-)

Cheers,
Ed Gerck

---

From: Ed Gerck <[email-masked]>
Date: Sun, 18 Apr 2004 18:41:47 -0700

Stefan,

On further thought, I'm even more indebted to your observation.
It is indeed possible and desirable to eliminate the "valid path" 
qualifier.

BTW, a new (hopefully improved) text shall be available tomorrow.

Cheers,
Ed Gerck