Subject: RE: cA flag and CRL issuers

From: Santosh Chokhani <[email-masked]>
Date: Fri, 25 May 2001 09:18:30 -0400

Dave:

My last response to Steve was a la yours, do not require generators to
assert the basicConstraints either.

-----Original Message-----
From: David P. Kemp [mailto:[email-masked]]
Sent: Friday, May 25, 2001 9:09 AM
Cc: [email-masked]
Subject: Re: cA flag and CRL issuers

Carlin Covey wrote:
> Some postings in this thread have attached significance to the fact that
> X.509 does not discuss whether the CA bit should be set when cRLSign is
true
> but keyCertSign is false.  I agree with you, Russ, that the discussion
> should center on the level of flexibility and complexity that the PKIX
> community want to embrace in its certificate and CRL profile, rather than
> the nuances of text omissions in X.509.

Yes.

> I also agree that Sharon does a fine job in representing X.509's view.  I
> understand that she is on vacation at the moment.

Yes!  It is exceedingly rare to find in one person her level of technical
understanding, fairness, and equanimity.  Thank you, Sharon. 

> All that said, let me now second Santosh's proposal: "I vote for not
> requiring the cA flag for CRL check and making appropriate changes to
X.509
> and to PKIX to make it clear and consistent."  - Santosh Chokhani, 24 May
> 2001

Yes.  However, for consistency you need a generation non-requirement
in addition to Santosh's recipient non-requirement:  I vote for not
requiring the cA flag for CRL generation or checking and for making
appropriate changes to X.509 and to PKIX to make them clear and consistent.

> To streamline the algorithm a little further, I suggest that we ask X.509
to
> allow the keyCertSign bit to be asserted in Attribute Authority
> certificates, as well as CA certificates.  As far as I can see, that would
> make the CRL validation algorithm identical for AA-issued and CA-issued
> CRL's.

No.  I support reserving the keyCertSign bit exclusively for use in
certificates of issuers of (public-) key certificates.

Regards,

Dave

---

From: "Michael Myers" <[email-masked]>
Date: Tue, 29 May 2001 10:07:44 -0700

All,

Regarding this thread, it seems to me that whether setting the cA bit for PK
certs, establishing algorithmic logic regarding naming or authorizations,
maybe in the long run inventing a cA bit equivalent for ACs or whatever
other technical mechanism we may devise, there exists a meta-requirement
that the provenance of a digital credential MUST link back in a technical
fashion to the source of its original issuance.  Is anyone else thinking the
same way or am I unique in this perspective?

Mike

Michael Myers
t: +415.819.1362
e: mailto:[email-masked]
w: http://www.traceroutesecurity.com