Subject: Certificate path processing

From: "Valery Smyslov" <[email-masked]>
Date: Mon, 3 Apr 2000 14:06:15 +0400

Hi,

I have a couple of questions regarding path processing. draft-ietf-
pkix-new-part1-01.txt states, that end entity may directly trust not 
only top CA in the hierarchy, but instead, some subordinate CA (for 
example, CA of end enity's own domain) and that it makes no 
difference to path validation algorithm. However, it seems to may 
make difference to path validation results. Consider the following 
example. Let's have CA hierarchy with top CA and two subordinate CA. 
Top CA imposes some constraints on first subordinate (for example, 
name constraint) while this subordinate imposes no constraints on its 
"son". In this situation, if end entity uses top CA or first 
subordinate as root CA, this constraints will be taken into 
consideration, while if it uses second subordinate CA as root CA - 
won't. Is it correct?
And another question: if end entity directly trusts some intermediate 
certificate in the path, does it means, that it may trust all 
certificates in the path, not only certificates below directly 
trusted, but also including certificates above it, up to the top? If 
the answer is "yes", it seems that the abovementioned possible 
difference in path validation results is incorrect. Am I wrong?

Thanks,
Valera.