Subject: RE: forward & reverse confusion

From: [email-masked]
Date: Sun, 23 Jul 2000 11:47:34 -0400

This naming does cause implementors to need to go over the standards
very carefully.  I would certainly favor "certForThis" and "certIssuedBy"
(not the plural, since there can only be one certificate in the element)
over the current wording, or perhaps "asSubject" and "asIssuer".  If even
one of the labels is changed, the confusion will vanish.

          Tom Gindin

Sharon Boeyen <[email-masked]> on 07/21/2000 11:33:06 AM

To:   "'Stephen Kent'" <[email-masked]>
cc:   [email-masked]
Subject:  RE: forward & reverse confusion

side issue:

In any conversation I have on these attributes or on path development or
on path processing, the terms 'forward' and 'reverse' cause confusion. I
suspect
I'm not alone in this.

How do folks feel about submitting a defect report that would replace those
terms in the crossCertificatePair attribute with less confusing ones (e.g.
certsIssuedToThisCA, certsIssuedByThisCA)? I'm certainly not wed to those
terms, but something along those lines that better conveys what they really
are.

Sharon

> -----Original Message-----
> From: Stephen Kent [mailto:[email-masked]]
> Sent: Friday, July 21, 2000 9:41 AM
> To: Sharon Boeyen
> Cc: [email-masked]
> Subject: RE: Reverse paths
>
>
> Sharon,
>
> >Steve,
> >I don't think I've been able to clearly describe what I meant. I am
> >NOT proposing ANY additional certificate issuance by anybody. I think
> >the terms reverse and forward are very unfortunate and always confuse
> >these discussions. Can we chat offline just to make sure that you
> >understand what it is I am proposing. Email makes this type of
> >discussion difficult at best.
> >
> >Within a hierarchy I don't believe any change is required.
> If the root
> >of a hierarchy issued a certificate to some CA that is NOT a
> subordinate
> >of the root, then currently PKIX does not require the root
> CA to place
> >that certificate in the root CA's entry. What I am proposing is that
> >such a certificate, IF ISSUED, be placed in the issuer's
> entry as well
> >as in the subject CA's entry.
>
> Ok, I think this clarification makes me more comfortable.
>
> Steve
>
> P.S.  All the negative comments about bridge CAs in my previous
> message still apply.
>