Subject: Certificate's Pointer to its Issuer's Certificate - AIA or IAN

From: "Bill Price" <[email-masked]>
Date: Fri, 8 Feb 2002 16:21:37 -0500

PKIX defined the AIA extension which includes a caIssuers type to point to
Issuing CA information. The content of the extension is a general name. The
Issuer Alternative Name (IAN) standard extension which also uses general
names could point to issuer information. Prior to the creation of the AIA
extension, at least one PKI used the URI form of IAN to point to an LDAP
directory entry that contained the issuer's information. The rationale was
to allow retrieval of the issuer's certificate.

I was wondering what was the rationale for not using the IAN when the AIA
caIssuers extension was created. I was also wondering if the PKIX path
discovery work would focus on use of the AIA caIssuers type and disregard
use of the IAN. At least one of the major vendors appears to have ignored
use of the IAN for path creation.

RFC 2459 does not seem to give any guidance on whether or how the IAN and
AIA relate other than what one might conclude from the extension names-IAN
provides an alternate name and AIA provides for information access. It seems
that they would or could have the same content since they both depend on
general names.

Thanks.

Bill Price

---

From: Stephen Kent <[email-masked]>
Date: Fri, 8 Feb 2002 17:10:33 -0500

At 4:21 PM -0500 2/8/02, Bill Price wrote:
>PKIX defined the AIA extension which includes a caIssuers type to 
>point to Issuing CA information. The content of the extension is a 
>general name. The Issuer Alternative Name (IAN) standard extension 
>which also uses general names could point to issuer information. 
>Prior to the creation of the AIA extension, at least one PKI used 
>the URI form of IAN to point to an LDAP directory entry that 
>contained the issuer's information. The rationale was to 
>allow retrieval of the issuer's certificate.
>
>I was wondering what was the rationale for not using the IAN when 
>the AIA caIssuers extension was created. I was also wondering if the 
>PKIX path discovery work would focus on use of the AIA caIssuers 
>type and disregard use of the IAN. At least one of the major vendors 
>appears to have ignored use of the IAN for path creation.
>
>RFC 2459 does not seem to give any guidance on whether or how the 
>IAN and AIA relate other than what one might conclude from the 
>extension names-IAN provides an alternate name and AIA provides for 
>information access. It seems that they would or could have the same 
>content since they both depend on general names.
>
>Thanks.
>
>Bill Price

Bill,

The semantics for IAN would not generally imply that the CA's cert 
and CRL would be located at a site pointed to by a URI contained in 
that field. The AIA extension has semantics that explicitly 
communicate this information, and allow for more info, e.g., access 
method, in cases when it is not encoded via a URI.

Steve