Subject: RE: On cross-certificates and pathLenConstraint

From: Stephen Kent <[email-masked]>
Date: Tue, 7 Sep 2004 10:33:08 -0400

At 3:28 PM +0100 9/3/04, Stefan Santesson wrote:
>Santosh.
>
>Short in-line
>
>
>>  -----Original Message-----
>>  From: [email-masked]
>[mailto:[email-masked]]
>>  On Behalf Of Santosh Chokhani
>>  Sent: den 3 september 2004 14:50
>>  To: [email-masked]
>>  Subject: RE: On cross-certificates and pathLenConstraint
>>
>>
>>  Stefan:
>>
>>  I would note two things.  They seem to be repeat of the themes from me
>in
>>  this thread.
>>
>>  1.  For interoperability reasons, it is not sufficient to reject paths
>>  considered bad by 3280.  Paths considered good by 3280 should also be
>>  accepted.
>>
>[Stefan] Agreed. I never meant to say anything else.
>
>>  2.  The key is the RP user to be able to set the path validation
>engine
>>  initialization variables as opposed to the engine/API making that
>>  determination for the entire consumer/RP community.
>
>[Stefan] Agreed. I never meant to say anything else. However the
>decision may not be taken by the user, it could be taken by his
>application, his manager, his It department or whatever.

It's your mention of "his application" that causes concern.  The user 
as RP should be able to make these decisions, or his management may 
do so based on corporate policy.  But if an application embodies 
these extra-standard decisions, and the app is not 
enterprise-specific, then we have a problem because the application 
vendor is not the RP and is no longer representing the wishes of the 
RP.

Steve

---

From: "Santosh Chokhani" <[email-masked]>
Date: Tue, 7 Sep 2004 10:43:05 -0400

For the benefit of both Stefan and Tom:

I agree with Steve Kent.  His articulation is much clearer than mine and is
unambiguous.

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]] 
Sent: Tuesday, September 07, 2004 10:33 AM
To: Stefan Santesson
Cc: Santosh Chokhani; [email-masked]
Subject: RE: On cross-certificates and pathLenConstraint

At 3:28 PM +0100 9/3/04, Stefan Santesson wrote:
>>  1.  For interoperability reasons, it is not sufficient to reject 
>> paths  considered bad by 3280.  Paths considered good by 3280 should 
>> also be  accepted.
>>

Steve