Subject: RE: Undefined combinations of extensions

From: Peter Williams <[email-masked]>
Date: Wed, 23 Aug 2000 09:44:35 -0700

5 years ago, based on academic research,
I specified a pre-PKIX1 PKI architecture in which variations
of the X.500 structure and content rules were applied to certificate
extensions to address this problem; It was 5 year too
early (like many of the things I do.) The architecture
exploited all the work of hierarchical distributed
schema specification, delegation and administration
accomplished by X.500 design for controlling
the security of distributed directories. The objects controlled
happened to be extensions, versus attributes
of entries, but the security management properties
were the same.

Perhaps you could reuse this idea, and invent 
something? Perhaps the time has come, now that
chains are beginning to matter.

Even better, as trusted directories are now coming
to the fore (based on modern X.500's standardization
of distributed directory security techniques), perhaps
we should make the directory the host for the
schema rules controlling cert extensions - rather than
embedding the structure/content rule in the superior
certificate of a chain.

-----Original Message-----
From: David Chadwick [mailto:[email-masked]]
Sent: Wednesday, August 23, 2000 9:36 AM
To: [email-masked]
Cc: Kurt D. Zeilenga; [email-masked]
Subject: Undefined combinations of extensions

On the LDAPExt list we have been discussing the effects of 
combinations of extensions (controls in LDAP jargon) on the LDAP 
server performing an LDAP operation, when the effects of the 
combination of one or more extensions is not understood by the 
server. The server may understand each separate extension, but 
not the semantics of them in combination.

It seems to me that PKIX/X.509 will have (or already may have 
encountered) this same problem for COMBINATIONS of certificate 
extensions (some of which may be private, some de-facto, some 
critical, some not) that are thought to be understood by the issuing 
CA, but are not fully understood by the relying party / validation 
engine.

What text does anyone have for this situation? I believe the recently 
issued X.509 defect report 244, raised by Sharon, only discusses 
the case of a single extension in isolation, and does not discuss the 
effects of combinations of extensions.

The most interesting cases are when the RP finds combinations of 
extensions, where each extension on its own is understood, but 
where the combined semantics are not fully understood (possibly 
due to incomplete or ambiguous specification of extension 
interactions when the extensions are written by different groups).  In 
this case, LDAP is suggesting that a receiver may ignore non-
critical extensions (even those it recognizes) to establish the 
semantics of the operation. This is in direct contrast to the wording 
of defect report 244, which states that an understood non-critical 
extension must be obeyed. The LDAP work would suggest an 
addition to DR244 along the lines of

" A validation engine that does not understand the interaction of a 
non-critical extension with another extension (critical or non-critical), 
may ignore the non-critical extension (even if it understands the 
semantics of the extension in isolation to the others), and accept the 
certificate (unless factors other than this extension cause it to be 
rejected).

A validation engine that does not understand the interaction of two 
critical extensions, must reject the certificate (even if it understands 
the semantics of both extensions in isolation to each other)."

David

***************************************************

David Chadwick
IS Institute, University of Salford, Salford M5 4WT
Tel +44 161 295 5351  Fax +44 161 745 8169
Mobile +44 790 167 0359
Email [email-masked]
Home Page  http://www.salford.ac.uk/its024/chadwick.htm
Understanding X.500  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string MLJ9-DU5T-HV8J

***************************************************

---

From: Sharon Boeyen <[email-masked]>
Date: Thu, 24 Aug 2000 09:47:12 -0400

I agree that this would be a valuable profiling activity and would hopefully
address the issues 
David raised without any impact on the criticality flag. 
 
PKIX could certainly impose requirements on the set of combinations that are
valid for a PKIX 
issued certificate, however validation engines still need to be able to cope
with PKIX and non-PKIX 
issued certificates.
 
Sharon 
 
 -----Original Message-----
From: Stephen Kent [mailto:[email-masked]]
Sent: Wednesday, August 23, 2000 3:34 PM
To: [email-masked]
Cc: [email-masked]; Kurt D. Zeilenga; [email-masked]
Subject: Re: Undefined combinations of extensions

David, 

Your question about combinations of extensions, and base certificate/CRL
fields, is a good one. Tim Polk and I discussed this issue during the last
PKIX WG meeting, in a more limited context. I proposed that we include a
table that described syntactic constraints among all the fields in a cert or
CRL, to address the question of which combinations of fields and values are
valid. One cannot do this for really private extensions, and doing it for
new extensions that are publicly disclosed is an ongoing task. But, at least
we should provide folks with a base set of constraints. I think 2459 should
do this and I volunteered to provide a draft table for this. 

Steve