Subject: Re: DPD & DPV requirements

From: Peter Sylvester <[email-masked]>
Date: Mon, 22 Jan 2001 18:30:40 +0100 (MET)

> 
> I would like to second Russ Housley's comments above for associating name
> constraints with trust anchors. Without naming constraints we would get
> security threats that would imply global trust, which is not a real life
> situation. If other words, I want to be able to detect when company X
> certifies a name from a user (or entity) from company Y, and when this is
> not allowed.
> 
> Denis
> 
>  

Can you give an example what do you want to do that you cannot
do with an appropriate cross certificate.

---

From: Russ Housley <[email-masked]>
Date: Mon, 22 Jan 2001 17:08:57 -0500

Peter:

Your question regarding cross-certificates makes an assumption about trust 
models that is not universal.  Also, the mechanism that I proposed allows 
the relying party, not a CA, is impose name constraints (in the same way 
that the relying party can impose policy constraints).

Russ