Subject: RE: CA strong binds

From: "Miklos, Sue A." <[email-masked]>
Date: Tue, 13 Oct 1998 15:21:51 -0400

Dave, 

I believe the discussion may have been related to "which data blob" goes
into the protocol exchange when performing an operation that calls out
"userCertificate", if the user is a CA.  Does the CA certificate (with a
different oid) get inserted into the exchange or does this require that
the CA also maintain a certificate (identical information?) with the oid
of a userCertificate.  

I realize this should be transparent, but wonder if others have
experiences with this.

Sandi

>----------
>From: 	Dave Horvath[SMTP:[email-masked]]
>Sent: 	Tuesday, October 13, 1998 2:44 PM
>To: 	Sean Turner; PKIX; Ldapext
>Subject: 	Re: CA strong binds
>
>
>Sean,
>
>    The only requirement that we have for the SafePages LDAP/X.500 products
>is that the certificate must have the digitalSignature bit asserted in the
>keyUsage field if it is a Version 3 certificate with the keyUsage extension
>present.    The other bits and the cA flag in the basicConstraints
>extensions are not consulted.
>
>    The existence or the location of the certificate in the repository does
>not play a role for authentication.
>
>Dave Horvath
>
>-----Original Message-----
>From: Sean Turner <[email-masked]>
>To: PKIX <[email-masked]>; Ldapext <[email-masked]>
>Date: Tuesday, October 13, 1998 1:41 PM
>Subject: CA strong binds
>
>
>>All,
>>
>>Appologies in advance if you get two of this message but I wasn't sure
>>which list to send the message to.
>>
>>Recently some colleagues and I have been arguing whether applications
>>will choke when looking for CA certificates in
>>CertificationPath.userCertificate.  For example, when a CA binds to an
>>LDAP server (using say the X.509 Authentication  SASL Mechanism I-D)
>>the CA's certificate will be passed in
>>certification-path.userCertificate and the CA's superiors certificates
>>are passed in certication-path.theCACertificates.  Will applications
>>choke when trying to process the CA certificate from a field called
>>userCertificate or when trying to look for a "user's certificate"
>>which is in a CA's directory entry?
>>
>>I know the name of the field shouldn't be confused with the value that
>>goes into it, but we were concerned that many of the specifications
>>were clear on where CA certificates should be put when attempting to
>>perform strong binds to the directory.
>>
>>Any thoughts - implementation experience?
>>
>>Thanks,
>>
>>spt
>>
>>
>
>

---

From: David Horvath <[email-masked]>
Date: Wed, 14 Oct 1998 11:56:32 -0400

Sandi,

	I don't believe the OID of the attribute (indicating where the
certificate came from) is included in the certification path as defined
in X.509.

Dave H