Subject: CP extension and OID tree structure

From: "Bechlaghem, Malek" <[email-masked]>
Date: Mon, 21 May 2007 19:13:04 +0400

Hi there,

My understanding of the path validation algorithm defined in RFC 3280 is
that the trust anchor public key certificate (root self-signed in the
case I am dealing with) is not part of the certificate path to be
validated by the path validation algorithm. It is then correct
considering that the root self-signed is not processed as such when
doing path validation as it is considered as an input to the path
validation algorithm. Therefore the root self-signed is not counted when
verifying whether a valid certificate policy tree exists. Is it correct
to conclude to the fact that the certificate policies extension in the
the self signed root is not processed when doing path validation.

The question is relevant to us as we will be implementing a PKI where
subordinate CA's CP extension will have only one OID value that could
even be the "AnyPOlicy" OID. So if the CP extension in the root
certificate will be processed by the path validation algorithm, this
would therefore put constraints on the values we would put in sb CAs
cert.

Thank you for your feedback.

Malek.

This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 21 May 2007 13:24:31 -0700

Malek,

It is correct that neither 3280 nor X.509 require the certificate
policies extension in the trust anchor to be processed.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Bechlaghem, Malek
Sent: Monday, May 21, 2007 11:13 AM
To: pkix
Subject: CP extension and OID tree structure

Hi there,

Malek.

This e-mail and any attachment is for authorised use by the intended
recipient(s) only. It may contain proprietary material, confidential
information and/or be subject to legal privilege. It should not be
copied, disclosed to, retained or used by, any other party. If you are
not an intended recipient then please promptly delete this e-mail and
any attachment and all copies and inform the sender. Thank you.