Subject: Bridge CA and crossCertificatePair

From: "Manuel Gil Perez" <[email-masked]>
Date: Thu, 11 Nov 2004 19:23:52 +0100

Dear PKIX members,

I need to develop a bridge CA where it must store one or more 
cross-certificates. Revising the RFCs (about LDAP, X.509, etc.) and looking 
up on the web I conclude that it is technically possible (in accordance with 
RFC 3280) to store one or more cross-certificate into my bridge CA (this 
value is multi-valued).

But really, according to the specification (see below), I can only store one 
pair of cross-certificates. Is it possible that the attribute 
CertificatePair is not correct and should be changed for the following??

CertificatePair ::= SEQUENCE SIZE(1..MAX) OF CertificateForwardReverse;

CertificateForwardReverse ::= SEQUENCE {
   forward [0] Certificate OPTIONAL,
   reverse [1] Certificate OPTIONAL,
   -- at least one of the pair shall be present -- }

In any case... can somebody send me the correct specification for the 
attribute CertificatePair??

Many thanks, and best regards...

------
Manuel Gil Pérez
http://pki.umu.euro6ix.org

======

pkiCA OBJECT-CLASS ::= {
   SUBCLASS OF { top}
   KIND auxiliary
   MAY CONTAIN {
      cACertificate |
      certificateRevocationList |
      authorityRevocationList |
      crossCertificatePair }
   ID joint-iso-ccitt(2) ds(5) objectClass(6) pkiCA(22) }

crossCertificatePair ATTRIBUTE ::= {
   WITH SYNTAX CertificatePair
   EQUALITY MATCHING RULE certificatePairExactMatch
    ID joint-iso-ccitt(2) ds(5) attributeType(4) crossCertificatePair(40) }

CertificatePair ::= SEQUENCE {
   forward [0] Certificate OPTIONAL,
   reverse [1] Certificate OPTIONAL,
   -- at least one of the pair shall be present -- }

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Fri, 12 Nov 2004 10:22:55 +0800

Pérez,

The syntax need not to be changed.

The crossCertificatePair is a multi-valued attribute.
That means you can store multiple CertificatePair
objects in a crossCertificatePair attribute.

Wen-Cheng Wang

---

From: Tom Gindin <[email-masked]>
Date: Fri, 12 Nov 2004 00:09:23 -0500

Manuel:

        CrossCertificatePair has AFAIK always been considered to be a 
multi-valued attribute, as you can see from (for example) RFC 2587 section 
3.2 where the existence of multiple CA Certificates in the caCertificate 
attribute and of multiple 'forward' elements in the crossCertificatePair 
attribute is discussed in consecutive paragraphs.  However, the 
certpathbuild draft lists userCertificate and caCertificate as 
multi-valued but doesn't make that statement about CrossCertificatePair. 
It should probably change to do so, unless it's too late in the process.
        Please note that the syntax of caCertificate is just a 
certificate, not a sequence of them.

                Tom Gindin

"Manuel Gil Perez" <[email-masked]>
Sent by: [email-masked]
11/11/2004 01:23 PM
Please respond to "Manuel Gil Perez"
 
        To:     <[email-masked]>
        cc: 

Dear PKIX members,

I need to develop a bridge CA where it must store one or more 
cross-certificates. Revising the RFCs (about LDAP, X.509, etc.) and 
looking 
up on the web I conclude that it is technically possible (in accordance 
with 
RFC 3280) to store one or more cross-certificate into my bridge CA (this 
value is multi-valued).

But really, according to the specification (see below), I can only store 
one 
pair of cross-certificates. Is it possible that the attribute 
CertificatePair is not correct and should be changed for the following??

------
Manuel Gil Pérez

======

pkiCA OBJECT-CLASS ::= {
   SUBCLASS OF { top}
   KIND auxiliary
   MAY CONTAIN {
      cACertificate |

crossCertificatePair ATTRIBUTE ::= {
   WITH SYNTAX CertificatePair
   EQUALITY MATCHING RULE certificatePairExactMatch
    ID joint-iso-ccitt(2) ds(5) attributeType(4) crossCertificatePair(40) 
}

---

From: "Matt Cooper" <[email-masked]>
Date: Fri, 12 Nov 2004 09:01:19 -0500

Quite right Tom, it is definitely multivalued.  If it was inferred that it
was not in the doc, it was in error.  Thanks for pointing this out, we'll
look at it.

And Manuel, to expand on what Tom's message, the encoding spec you
originally found is correct. The encoding should be a single pair of
certificates. As Tom said, since crossCertificatePair is multivalued, you
simply store as many encoded pairs as you need in the directory.  It's just
like certificates; the ASN.1 spec is only for one certificate; and you may
store as many as you need in the directory.

Incidentally, the reason crossCertificatePair is done this way is so that
related cross certificates may be associated. In other words, if we are CAs
and I were to issue you a certificate and you were to issue me a
certificate, we would put these two certificates together as a pair in our
respective crossCertificatePair entries.

Matt Cooper
Orion Security Solutions
1489 Chain Bridge Road, Suite 300 
McLean, Virginia 22101
(Mob) 703.981.2269
(Off) 703.917.0060 x. 30
(Fax) 703.917.0260
Visit our website!
http://www.orionsec.com

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Tom Gindin
Sent: Friday, November 12, 2004 12:09 AM
To: Manuel Gil Perez; Matt Cooper
Cc: [email-masked]
Subject: Re: Bridge CA and crossCertificatePair

        Manuel:

        CrossCertificatePair has AFAIK always been considered to be a
multi-valued attribute, as you can see from (for example) RFC 2587 section
3.2 where the existence of multiple CA Certificates in the caCertificate
attribute and of multiple 'forward' elements in the crossCertificatePair
attribute is discussed in consecutive paragraphs.  However, the
certpathbuild draft lists userCertificate and caCertificate as multi-valued
but doesn't make that statement about CrossCertificatePair. 
It should probably change to do so, unless it's too late in the process.
        Please note that the syntax of caCertificate is just a certificate,
not a sequence of them.

                Tom Gindin

        To:     <[email-masked]>
        cc: 

Dear PKIX members,

------
Manuel Gil Pérez

======

pkiCA OBJECT-CLASS ::= {
   SUBCLASS OF { top}
   KIND auxiliary
   MAY CONTAIN {
      cACertificate |

---

From: Tom Gindin <[email-masked]>
Date: Fri, 12 Nov 2004 00:09:23 -0500

Manuel:

                Tom Gindin

        To:     <[email-masked]>
        cc: 

Dear PKIX members,

------
Manuel Gil Pérez

======

pkiCA OBJECT-CLASS ::= {
   SUBCLASS OF { top}
   KIND auxiliary
   MAY CONTAIN {
      cACertificate |

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Fri, 12 Nov 2004 10:22:55 +0800

Pérez,

Wen-Cheng Wang

---

From: "Matt Cooper" <[email-masked]>
Date: Fri, 12 Nov 2004 09:01:19 -0500

Matt Cooper
Orion Security Solutions

-----Original Message-----

        Manuel:

                Tom Gindin

        To:     <[email-masked]>
        cc: 

Dear PKIX members,

------
Manuel Gil Pérez

======

pkiCA OBJECT-CLASS ::= {
   SUBCLASS OF { top}
   KIND auxiliary
   MAY CONTAIN {
      cACertificate |

---

From: "Manuel Gil Perez" <[email-masked]>
Date: Thu, 11 Nov 2004 19:23:52 +0100

Dear PKIX members,

------
Manuel Gil Pérez

======

pkiCA OBJECT-CLASS ::= {
   SUBCLASS OF { top}
   KIND auxiliary
   MAY CONTAIN {
      cACertificate |

---

From: "Manuel Gil Perez" <[email-masked]>
Date: Tue, 16 Nov 2004 20:50:34 +0100

Many thanks to all.

Now, I understand how these attributes are managed. In the doc it's not very 
precise.

Thanks.

------
Manuel Gil Pérez

----- Original Message ----- 
Sent: Friday, November 12, 2004 3:01 PM
Subject: RE: Bridge CA and crossCertificatePair

> multi-valued

---

From: "Manuel Gil Perez" <[email-masked]>
Date: Tue, 16 Nov 2004 20:47:59 +0100

Wen-Cheng...

In line...

----- Original Message ----- 
Sent: Friday, November 12, 2004 3:22 AM
Subject: Re: Bridge CA and crossCertificatePair

> The syntax need not to be changed.

Agree.

> objects in a crossCertificatePair attribute.

I think that your comment isn't correct. "The crossCertificatePair is a 
multi-valued attribute"... perfect, but you can only store a CertificatePair 
in a crossCertificatePair attribute. This crossCertificatePair attribute can 
appear zero, one or more times in the pkiCA entry.

Regards.

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Wed, 17 Nov 2004 09:47:41 +0800

Manuel,

You misinterpret the meaning of a multi-valued
attribute.

I am sure that by "a multi-valued attribute"
it means that one can store multiple values
in a single attribute. I recommend you to
read the LDAP spec.

Wen-Cheng Wang