Subject: [IPsec] Issue #31 Clarification re: Cert Signature payload

From: Tero Kivinen <[email-masked]>
Date: Tue, 23 Sep 2008 16:00:37 +0300

> >     o  X.509 Certificate - Signature (4) contains a DER encoded X.509
> >        certificate whose public key is used to validate the sender's AUTH
> >        payload.
> 
> That certificate can also bve used as part of the chain. I.e. add
> 
>     or used in the validation.
> 
> to the end of that paragraph.
> 
> ===Not done. It already says this.

I bit disagree with this, as certificate that is used to sign the end
users certificate are not directly "used to validate the sender's AUTH
payload". It is used to validate the certificate used to validate
sender's AUTH payload, but it depends how strictly you interpret the
"sender's AUTH payload" part.

But anyways this is not really that important case, I just tought it
would make it easier to understand that there can be other
certificates from the chain in sent inside the IKEv2 CERT payloads
too, than just the one used to validate the sender's AUTH payload
(there is text about this already at the end of 3.6 where it says the
first CERT payload must be the one that whose public key is used to
sign the AUTH payload).

I remember that I have seen at least several IKEv1 implementations who
didn't like any extra certificates sent to them. Don't remember if any
of those bugs were really present in IKEv2 implementations. 
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 23 Sep 2008 09:30:27 -0700

>"sender's AUTH payload" part.

That is a tortured view of validating.

--Paul Hoffman, Director
--VPN Consortium