Subject: RE: On cross-certificates and pathLenConstraint

From: Stephen Kent <[email-masked]>
Date: Thu, 9 Sep 2004 13:31:42 -0400

At 6:17 PM +0100 9/9/04, Stefan Santesson wrote:
>Yes,
>That is what I'm saying.
>The NIST test doesn't catch that though.
>
>You can say that MSCAPI is almost faithful to RFC 3280 (with all the
>best intentions) but there are other minor deviations as well that we
>have on our list.
>
>/Stefan

Well, this suggests that the NIST test suite needs to be more 
comprehensive. Our discussion shows that non-compliance  can be 
determined independent of a test suite, whereas successful execution 
of a test suite only increases confidence in compliance :-)  The 
usual partial testing vs. counter-example issue.

Steve

---

From: [email-masked] (Peter Gutmann)
Date: Sat, 11 Sep 2004 15:32:39 +1200

Stephen Kent <[email-masked]> writes:

>Well, this suggests that the NIST test suite needs to be more comprehensive.

Either that or the folks who created the test suite knew what sort of snake-
pit they were getting into by adding checks for this :-).

Peter.