Subject: RE: Reverse paths

From: Sharon Boeyen <[email-masked]>
Date: Fri, 21 Jul 2000 08:53:30 -0400

Steve,
I don't think I've been able to clearly describe what I meant. I am 
NOT proposing ANY additional certificate issuance by anybody. I think
the terms reverse and forward are very unfortunate and always confuse 
these discussions. Can we chat offline just to make sure that you 
understand what it is I am proposing. Email makes this type of 
discussion difficult at best. 

Within a hierarchy I don't believe any change is required. If the root
of a hierarchy issued a certificate to some CA that is NOT a subordinate
of the root, then currently PKIX does not require the root CA to place 
that certificate in the root CA's entry. What I am proposing is that 
such a certificate, IF ISSUED, be placed in the issuer's entry as well 
as in the subject CA's entry. 

> -----Original Message-----
> From: Stephen Kent [mailto:[email-masked]]
> Sent: Thursday, July 20, 2000 6:04 PM
> To: Steve Hanna
> Cc: [email-masked]
> Subject: Re: Reverse paths
> 
> 
> At 10:04 AM -0400 7/20/00, Steve Hanna wrote:
> >Stephen Kent wrote:
> >  > I am uncomfortable with the proposal that we mandate 
> both elements,
> >  > as this would seem to imply that every CA would have to engage in
> >  > reverse path certificate generation in all contexts.  Did I
> >  > misunderstand the implication?
> >
> >I'm not sure what you mean by "reverse path certificate generation". 
> >This change would require that
> >when a CA issues a cross certificate, they would have to place a 
> >copy of it in their own directory
> >entry (in the reverse element of a value of the crossCertificate 
> >attribute). It would not require the
> >generation of any additional certificates.
> 
> I though Sharon suggested that each CA entry would hold mandated 
> pairs of cross certs, one forward and one back, for each CA it was 
> being linked to. In today's mostly hierarchic environment, a CA 
> issues a forward cert (using X.509 terminology) to CAs "below" it and 
> is certified by CAs "above" it, but CAs do not usually generate the 
> other, reverse certs, even though they are defined and a valid part 
> of the X.509 model.  Only when CAs in different organizational 
> domains certify one another is there typically a a pair of certs 
> available. Thus, if one were to impose a constraint, via LDAP, that 
> caused CAs to issues reverse certs, it would constitute a major 
> change in the way most PKIs today are arranged.
> 
> >
> >  > I know that Entrust has always encouraged (required?) 
> this type of
> >  > cross certification among CAs, but it doesn't seem that other CA
> >  > vendors or most users have. I would not think it appropriate to
> >  > impose this sort of requirement, given the vendor-specific
> >  > implications of such a change.
> >
> >I don't see this as a vendor-specific issue, but rather as an aid to 
> >building certification paths.
> 
> It is vendor specific in so far as Entrust products have long 
> (always?) issued reverse certs, while no other major products have.
> 
> Steve
>

---

From: Stephen Kent <[email-masked]>
Date: Fri, 21 Jul 2000 09:40:47 -0400

Sharon,

>as in the subject CA's entry.

Ok, I think this clarification makes me more comfortable.

Steve

P.S.  All the negative comments about bridge CAs in my previous 
message still apply.