Subject: RE: "Basic" path-validation question

From: "James Jing" <[email-masked]>
Date: Mon, 20 Jan 2003 12:53:33 +1100

So you really want to check whether a certificate is valid for A PURPOSE. I suppose this is beyond general path validation, but it definitely is a real-world issue.

My suggested approach would be to query your validation server/library by indicating how the certificate is going to be used, perhaps using a policy identifier. 

Regards

James Jing

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Friday, 17 January 2003 11:22 PM
To: Richard Levitte - VMS Whacker; [email-masked]
Subject: Re: "Basic" path-validation question

>> Below we have a little scheme where an RP have
>> "accepted" CA1 by "installing" the RootCA and CA1
>> in the trust-store:
>> 
>>      /CA1->EE_type1 (class 3 id)
>> RootCA-CA2->EE_type2 (low assurance e-mail)
>>      \CA3->EE_type3 (web-server-cert)
>> 
>> Now, the RP receives a message containing a path
>> of CA3 + EE_type3.
>> 
>> What should a conforming path-validation say about this?

>Since the RP already has RootCA in it's store, and supposedly trusts
>it, and it verifies CA3 which in turn verifies EE_type3, the path is
>validated.  No problemo.  Or did I miss something?

Nema problema.  Except for the fact that the RP probably only agreed
to accept class 3 id's and now got fooled by the path-validation.

Isn't this what we engineers call "broken" eh?

<snip>

Anders

---

From: Stephen Kent <[email-masked]>
Date: Mon, 20 Jan 2003 18:44:54 -0500

At 12:53 PM +1100 1/20/03, James Jing wrote:
>So you really want to check whether a certificate is valid for A 
>PURPOSE. I suppose this is beyond general path validation, but it 
>definitely is a real-world issue.
>
>My suggested approach would be to query your validation 
>server/library by indicating how the certificate is going to be 
>used, perhaps using a policy identifier.

Yes this is completely within the province of the DPD/DPV specs, 
where an application can specify the policy relative to which a cert 
should be validated.

Steve