Subject: [pkix] TBSCertificate as trust anchor information

From: "Erik Andersen" <[email-masked]>
Date: Sun, 8 May 2011 17:34:50 +0200

When a TSBCertificate provides trust anchor information, is it then a
requirement that the subject and the issuer are the same entity?

Is a TBSCertificate used for anything else that for trust anchor
information?

Erik Andersen

---

From: Eric Norman <[email-masked]>
Date: Sun, 08 May 2011 11:10:11 -0500

On May 8, 2011, at 10:34 AM, Erik Andersen wrote:

> When a TSBCertificate provides trust anchor information, is it then a requirement that the subject and the issuer are the same entity?

I say no.  I should have the ability to mark any public key/subject pair that I choose as trustworthy.
In other words, what's a trust anchor is something I decide, not someone else.  Yes, that means
that I probably have to do some out-of-band stuff, but that's not a problem PKIX can solve.

EJN

---

From: Santosh Chokhani <[email-masked]>
Date: Sun, 8 May 2011 12:29:30 -0400

Erik,

Also see Section 3 of RFC 5914 for usage of TBSCertificate.

In that usage, it need not have the issuer and subject the same entity.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Erik Andersen
Sent: Sunday, May 08, 2011 11:35 AM
To: PKIX
Subject: [pkix] TBSCertificate as trust anchor information

Is a TBSCertificate used for anything else that for trust anchor information?

Erik Andersen

---

From: Tom Gindin <[email-masked]>
Date: Tue, 10 May 2011 20:13:04 -0400

The most meaningful signature possible on a trust anchor would be 
the Relying Party's own, or that of a single party trusted by the RP as a 
TA issuer.  The issuer name of a trust anchor has no particular meaning 
specific to RFC 5914 or any path validation, so it might as well mean "the 
named entity is the one who actually decided to trust this TA".

                Tom Gindin

From:   Santosh Chokhani <[email-masked]>
To:     Erik Andersen <[email-masked]>, PKIX <[email-masked]>
Date:   05/08/2011 12:30 PM
Subject:        Re: [pkix] TBSCertificate as trust anchor information
Sent by:        [email-masked]

Erik,

 
From: [email-masked] [mailto:[email-masked]] On Behalf Of 
Erik Andersen
Sent: Sunday, May 08, 2011 11:35 AM
To: PKIX
Subject: [pkix] TBSCertificate as trust anchor information

 
Erik Andersen
 _______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix

---

From: Santosh Chokhani <[email-masked]>
Date: Tue, 10 May 2011 20:29:54 -0400

Tom,

So, do you agree that issuer and subject DN in TBSCertificate structure need not be the same?

-----Original Message-----
From: Tom Gindin [mailto:[email-masked]] 
Sent: Tuesday, May 10, 2011 8:13 PM
To: Santosh Chokhani
Cc: Erik Andersen; PKIX
Subject: Re: [pkix] TBSCertificate as trust anchor information

                Tom Gindin

Erik,

 

 
Erik Andersen

---

From: Tom Gindin <[email-masked]>
Date: Wed, 11 May 2011 07:25:54 -0400

Yes.  I was suggesting that issuer isn't actually used for 
anything much, so there's no reason for it to be the same as subject. It's 
the same as subject when the CA itself signs and distributes the root, 
which is the most usual practice.  There is AFAIK nothing stopping someone 
from using a cross-certificate as an anchor, and there should be nothing 
stopping someone from using the TBS section of that as an anchor.

Tom Gindin

From:   Santosh Chokhani <[email-masked]>
To:     Tom Gindin/Watson/IBM@IBMUS
Cc:     Erik Andersen <[email-masked]>, PKIX <[email-masked]>
Date:   05/10/2011 08:30 PM
Subject:        RE: [pkix] TBSCertificate as trust anchor information

Tom,

So, do you agree that issuer and subject DN in TBSCertificate structure 
need not be the same?

-----Original Message-----
From: Tom Gindin [mailto:[email-masked]] 
Sent: Tuesday, May 10, 2011 8:13 PM
To: Santosh Chokhani
Cc: Erik Andersen; PKIX
Subject: Re: [pkix] TBSCertificate as trust anchor information

                Tom Gindin

Erik,

 

 
Erik Andersen