Subject: Re: Last Call: draft-ietf-pkix-new-part1-06.txt comments

From: Denis Pinkas <[email-masked]>
Date: Wed, 02 May 2001 18:12:45 +0200

Russ,

This is fine in general. I would however prefer to move the two first
sentences from 6.1 at the end of 6.1. This would lead to:

    The path validation process determines the set of certificate policies
    that are valid for this path, based on the certificate policies
    extension, policy mapping extension, policy constraints extension,
    and inhibit any-policy extension.  To achieve this, the path
    validation algorithm constructs a valid policy tree.  If the set of
    certificate policies that are valid for this path is not empty, then
    the result will be a valid policy tree of depth n, otherwise the
    result will be a null valid policy tree. A particular certification 
    path may not, however, be appropriate for all applications.  
    Therefore, an application MAY augment this algorithm to further 
    limit the set of valid paths.

Regards,

Denis 

> Denis:
> 
> I agree with Steve Hanna's observation.  However, I think that we can
> include a bit of notice in section 6.1.  I propose the following
> replacement paragraph:
> 
>     A particular certification path may not, however, be appropriate for
>     all applications.  Therefore, an application MAY augment this
>     algorithm to further limit the set of valid paths.  The path
>     validation process also determines the set of certificate policies
>     that are valid for this path, based on the certificate policies
>     extension, policy mapping extension, policy constraints extension,
>     and inhibit any-policy extension.  To achieve this, the path
>     validation algorithm constructs a valid policy tree.  If the set of
>     certificate policies that are valid for this path is not empty, then
>     the result will be a valid policy tree of depth n, otherwise the
>     result will be a null valid policy tree.
> 
> I suggest that we replace the first paragraph of section 6.2. with:
> 
>     The path validation algorithm describes the process of validating a
>     single certification path.  While each certification path begins with
>     a specific trust anchor, there is no requirement that all
>     certification paths validated by a particular system share a single
>     trust anchor.  An implementation that supports multiple trust anchors
>     MAY augment the algorithm presented in section 6.1 to further limit
>     the set of valid certification paths which begin with a particular
>     trust anchor.  For example, an implementation MAY modify the
>     algorithm to apply name constraints to a specific trust anchor during
>     the initialization phase, or the application MAY require the presence
>     of a particular alternative name form in the end entity certificate,
>     or the application MAY impose requirements on application-specific
>     extensions.  Thus, the path validation algorithm presented in section
>     6.1 defines the minimum conditions for a path to be considered valid.
> 
> Russ

---

From: Steve Hanna <[email-masked]>
Date: Wed, 02 May 2001 17:23:58 -0400

This is fine with me.

-Steve