Subject: pathLenConstraint

From: "Kuhn, Sebastien" <[email-masked]>
Date: Fri, 13 Jan 2006 16:24:49 +0100

Hello,

Could you confirm that the attribute "pathLenConstraint" (included in the
extension "BasicConstraints") can have no limit in a Root CA certificate and
a finite value in a CA certificate subordinate to the Root CA ?

Thank you in advance.

Sebastien.

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Mon, 16 Jan 2006 14:36:50 +0100 (CET)

In message <[email-masked]> on Fri, 13 Jan 2006 16:24:49 +0100, "Kuhn, Sebastien" <[email-masked]> said:

sebastien.kuhn> Could you confirm that the attribute
sebastien.kuhn> "pathLenConstraint" (included in the extension
sebastien.kuhn> "BasicConstraints") can have no limit in a Root CA
sebastien.kuhn> certificate and a finite value in a CA certificate
sebastien.kuhn> subordinate to the Root CA ?

Yes, as far as I understand.  I can't really imagine why it shouldn't

Cheers,
Richard

-----
Please consider sponsoring my work on free software.
See http://www.free.lp.se/sponsoring.html for details.

-- 
Richard Levitte                         [email-masked]
                                        http://richard.levitte.org/

"When I became a man I put away childish things, including
 the fear of childishness and the desire to be very grown up."
						-- C.S. Lewis

---

From: Tom Gindin <[email-masked]>
Date: Mon, 16 Jan 2006 22:29:19 -0500

If the verifier follows RFC 3280 6.1.4 steps L and M, 
pathLengthConstraint seems to have real effect in an intermediate 
certificate either only if it is less than the previous value of the 
length constraint minus one.  Step M suggests that pathLengthConstraint 
should be ignored if this is not the case.  The algorithm assumes that the 
length constraint is initialized to a non-negative integer, although it 
can be a large one.
        Sebastien's suggested setup is fine, of course.

                Tom Gindin

Richard Levitte - VMS Whacker <[email-masked]>
Sent by: [email-masked]
01/16/2006 08:36 AM
 
        To:     [email-masked]
        cc:     [email-masked]
        Subject:        Re: pathLenConstraint

In message 
<[email-masked]> on Fri, 
13 Jan 2006 16:24:49 +0100, "Kuhn, Sebastien" <[email-masked]> 
said:

Cheers,
Richard

-----