Subject: Question about RootCA

From: 王炳艳 <[email-masked]>
Date: Mon, 1 Jul 2002 16:10:44 +0800

I was puzzled by the term "root CA" in rfc2510 (CMP).

 The below paragraph is from 1.2.2. 
    We use the term "root CA" to indicate a CA that is directly trusted
    by an end entity; that is, securely acquiring the value of a root CA
    public key requires some out-of-band step(s). This term is not meant
                                                  ----------------------
    to imply that a root CA is necessarily at the top of any hierarchy,
    ------------------------------------------------------------------
    simply that the CA in question is trusted directly.
    --------------------------------------------------
 If there are two CA certificates,
                cert a                       cert b(signed by cert a)
    Issuer    C=US,OU=TSA,CN=a            C=US,OU=TSA,CN=a
    
    subject   C=US,OU=TSA,CN=a            C=US,OU=TSA,CN=b
 
 According to the above statement, certificate b is a "root CA" if there is an 
 end entity trust it.

 Then comes the question about Root CA Key update in Section 2.4.    
    The basis of the procedure described here is that the CA protects its
    new public key using its previous private key and vice versa. Thus
    when a CA updates its key pair it must generate two extra cACertificate 
    attribute values if certificates are made available using an X.500 directory 
    (for a total of four:  OldWithOld; OldWithNew; NewWithOld; and NewWithNew).
                           --------------------------------------------------
 If the CA operator want to update key for cert b, what does the four certificate mean?
                OldWithOld        OldWithNew        NewWithOld         NewWithNew
  Issuer   C=US,OU=TSA,CN=a          ?                 ?                   ?
    
  subject  C=US,OU=TSA,CN=b          ?                 ?                   ?

  signer       cert a                ?                 ?                   ?

Thanks for any answer.
wang bing yan
										[email-masked]
                   　　　　　　　　　　　　　　　2002-07-01