Subject: RE: Problem with PKIX part 1 basicConstraints

From: "Flanigan, Bill" <[email-masked]>
Date: Thu, 19 Nov 1998 15:57:52 -0500

Not really.  Although it, of course, depends on the application (not the PKI
per se), Basic Constraints, well, constrain EEs from acting as CAs; Key
Usage bit set(s) indicate(s), well, key usage.  What would happen if an
app's certs have BC = not used (or c=no), and KU = keyCertSign, cRLSign?
Since every EE can now be its own CA, I'll let you guess!

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
William F. Flanigan, Jr., Ph.D.       Voice:           (703) 681-2318
Defense Information Systems Agency      Fax:           (703) 681-2814 
Information Assurance Office (JED)      DSN:                      761      
5600 Columbia Pike, Room 632     Voice Mail:           (703) 681-2318   
Falls Church, VA 22041-2717        Internet:  <[email-masked]>
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

> -----Original Message-----
> From:	Brian Korver [SMTP:[email-masked]]
> Sent:	Thursday, November 19, 1998 1:58 AM
> To:	[email-masked]
> Cc:	[email-masked]
> Subject:	Re: Problem with PKIX part 1 basicConstraints
> 
	[snip]

> Don't forget about the KeyUsage extention.  When this extention is
> present,
> the BasicConstraints extension is redundant in EE certifications.
> 
	[snip]

> -brian
> [email-masked]

---

From: Brian Korver <[email-masked]>
Date: Thu, 19 Nov 1998 16:01:50 -0800

>Since every EE can now be its own CA, I'll let you guess!

Bill,

In theory, not what you think -- such a cert is malformed.

According to my copy of the amendments DAM (section 12.2.2.3 "Key usage
field"):

   The bits keyCertSign and cRLSign are for use in CA-certificates only,
   and if the basic constraints extension (see 12.4.2.1) is present in
   the same certificate the values in the subjectType field of that
   extension and in the key usage restriction shall not conflict.

So, according to X.509 law, "BC=not used" cannot legally appear with
"K=keyCertSign,cRLSign".

-brian
[email-masked]