Subject: RE: 3280bis: CRL validation: what is wrong and/or missing in section 6.3

From: "Santosh Chokhani" <[email-masked]>
Date: Tue, 12 Jul 2005 08:04:57 -0400

David Cooper,

At a minimum, the cogent paragraph in the security consideration section
should be enhanced to recommend use of name constraints when cross
certifying with a CA in another PKI.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Jean-Marc Desperrier
Sent: Tuesday, July 12, 2005 2:53 AM
To: [email-masked]
Subject: Re: 3280bis: CRL validation: what is wrong and/or missing in
section 6.3

David A. Cooper wrote:

> Even though X.509 requires that names be unambiguous, there does seem
> to be consensus within the PKIX WG that 3280bis should impose some 
> restrictions of the certification path used to validate a CRL in order 
> to address the concern that a name collision might occur despite 
> X.509's prohibition.  However, at the moment, WG consensus seems to be 
> in favor of only requiring that the certification path for the CRL use 
> the same trust anchor as the certification path for the corresponding 
> CRL.  There is language about this in the security considerations 
> section.  In order for 3280bis to be even more restrictive, it would 
> need to be shown that there is WG consensus in favor of imposing such 
> restrictions.

I support more restrictions. If you wish to be able to use 
cross-certification to interoperate with other PKI and not  multiply the 
trust anchors used, "the same trust anchor" does not mean much 
constraint at all.