Subject: RE: pathLenConstraint

From: "Stefan Santesson" <[email-masked]>
Date: Mon, 16 Jan 2006 23:42:10 -0000

Sebastien,

Technically, all extensions in a Root certificate can be ignored by the
relying party since they are not used as input to the path validation
process.

Section 6.1.1. of RFC 3280 states the input from the selected trust
anchor:

      (d)  trust anchor information, describing a CA that serves as a
      trust anchor for the certification path.  The trust anchor
      information includes:

         (1)  the trusted issuer name,
         (2)  the trusted public key algorithm,
         (3)  the trusted public key, and
         (4)  optionally, the trusted public key parameters associated
         with the public key.

It can be debatable however if this is good or bad. The practice of our
(Microsoft) implementation is to by default process the extensions of
the root certificate (they probably was put there for some reason so we
honor them). In either case, your setup would work just fine.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Richard Levitte - VMS Whacker
Sent: den 16 januari 2006 05:37
To: [email-masked]
Cc: [email-masked]
Subject: Re: pathLenConstraint

In message
<[email-masked]> on Fri,
13 Jan 2006 16:24:49 +0100, "Kuhn, Sebastien" <[email-masked]>
said:

sebastien.kuhn> Could you confirm that the attribute
sebastien.kuhn> "pathLenConstraint" (included in the extension
sebastien.kuhn> "BasicConstraints") can have no limit in a Root CA
sebastien.kuhn> certificate and a finite value in a CA certificate
sebastien.kuhn> subordinate to the Root CA ?

Yes, as far as I understand.  I can't really imagine why it shouldn't

Cheers,
Richard

-----
Please consider sponsoring my work on free software.
See http://www.free.lp.se/sponsoring.html for details.

-- 
Richard Levitte                         [email-masked]
                                        http://richard.levitte.org/

"When I became a man I put away childish things, including
 the fear of childishness and the desire to be very grown up."
						-- C.S. Lewis