Subject: Re: RFC 3280: same certificate in a certification path

From: [email-masked] (Peter Gutmann)
Date: Fri, 27 Jun 2003 13:53:31 +1200

Stephen Kent <[email-masked]> writes:

>Huh? the RP is responsible for acquiring the necessary certs and CRLs to
>validate a signature.

Right, and the fact that that works so well in practice is why every widely-
used protocol that uses certs has the sender supply them.  The end user's
options are to either have the sender supply all the certs, or to wait for
X.500 (or however the receiver is supposed to find the certs it needs) to
suddenly start working.  I'll put my money on sender-supplies-certs, thanks.

>>I'll even go so far as to say that it's OK for the receiver to deny
>>verification if the sender doesn't supply all the certificates needed.
>
>You'll be treading on very thin ice if you make this assertion.

Seems to be a sensible way to ensure that things work in the real world.

I guess I'll finish up with a quote from my home page:

  I think a lot of purists would rather have PKI be useless to anyone in any
  practical terms than to have it made simple enough to use, but potentially
  "flawed".
         -- Chris Zimman.

Peter.

---

From: Stephen Kent <[email-masked]>
Date: Fri, 27 Jun 2003 10:28:53 -0400

>   practical terms than to have it made simple enough to use, but potentially

Peter,

You and I fundamentally disagree about how to make things work 
better. I favor creating standards that show the way, and hoping that 
the market will eventually persuade vendors to follow these 
standards.  You seem to want to create ad hoc workarounds to 
accommodate whatever a vendor had done. I see merit in your approach, 
from the perspective of a user who merely wants things to work NOW, 
and does not care how or why.  However, in the long run this has been 
show to be a bad approach, at least in terms of Internet standards 
experience.

In that light, I am still comfortable with my advice above.

Steve