Subject: RE: Path Validation Variables

From: Santosh Chokhani <[email-masked]>
Date: Tue, 10 Nov 1998 16:22:54 -0500

I agree with Dave that the current draft does not permit an application
force policy checking.

> -----Original Message-----
> From:	Simonetti David [SMTP:[email-masked]]
> Sent:	Tuesday, November 10, 1998 3:02 PM
> To:	IETF-PKIX
> Subject:	Path Validation Variables
> 
> The PKIX Profile provides three elements by which to control
> certificate
> policy processing:  the Certificate Policies and Policy Constraint
> extensions, and a set of initial policy identifiers (X.509 calls this
> initial-policy-set).  
> 
> Based on the Basic Path Validation procedues in Section 6.1, these
> three
> elements may interact in a way that allows the application to
> determine:
>  - whether at least one policy present in the initial-policy-set is
> consistently present in all the certs in the certification path (via a
> critical Certificate Policies extension in EACH cert); or
>  - whether at least one policy present in the initial-policy-set is
> present in each cert in the certification path beginning at some point
> (via a critical (or non-critical?) Policy Constraints extension).
> 
> Notice that policy processing in both of these situations is dependent
> on the CA including the associated extension.  Therefore, if these
> extensions are not included in a certificate, then the relying party
> has
> no contribution to this policy processing (initial-policy-set will be
> ignored).
> 
> This seems counterintuitive.  As the relying party I should be allowed
> to have some input on the policies that I accept.  For example, if I
> want my high assurance financial application to only accept other high
> assurance financial certificates, then my application should be able
> to
> implement this constraint.  
> 
> This could be accomplished by setting the initial value of the
> "explicit
> policy state variable" to zero, and including only the "high assurance
> financial certificates" policy into my initial-policy-set.  However,
> PKIX states that the "explicit policy state variable" is set to n+1,
> where n=cert-path-length.  As a result, the initial-policy-set will
> only
> be checked throughout the cert path if the first cert in the path
> includes a policyConstraints extension with requireExplicitPolicy set
> to
> zero.  As a user I have no control over this.
> 
> Has anyone else analyzed this?  X.509 gets around this issue by not
> indicating any initial value for these variables (at least that leaves
> it ambiguous).  I'd like to know if my analysis is valid, and if so
> propose that either there be no recommended initial value for
> "explicit
> policy state variable", or that an initial value of zero be explicitly
> allowed.
> -- 
> David Simonetti, Booz·Allen & Hamilton Inc.

---

From: Dean Povey <[email-masked]>
Date: Thu, 12 Nov 1998 08:22:11 +1000

>I agree with Dave that the current draft does not permit an application

Ditto.  I think this is a valid point.  Is it possible for someone to update 
the Certificate profile if there are no other objections?

-- 
Dean Povey,         | e-m: [email-masked]     | Cryptozilla:
Research Scientist  | ph:  +61 7 3864 5120       |  www.cryptozilla.org/
Security Unit, DSTC | fax: +61 7 3864 1282       | Oscar - PKI Toolkit:
Brisbane, Australia | www: security.dstc.edu.au/ |  oscar.dstc.qut.edu.au/