Subject: RE: draft-ietf-pkix-rfc3280bis-04.txt

From: Sharon Boeyen <[email-masked]>
Date: Wed, 12 Jul 2006 10:06:16 -0400

I agree and urge that caIssuers not be overloaded. A new access method
should be defined for pointing to an attribute certificate. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Carl Wallace
Sent: Wednesday, July 12, 2006 9:06 AM
To: David Chadwick; David A. Cooper
Cc: pkix
Subject: RE: draft-ietf-pkix-rfc3280bis-04.txt

> Secondly, you forgot to mention the use of
> AuthorityKeyIdentifier which according to 3280 is " a means 
> of identifying the public key corresponding to the private 
> key used to sign a certificate." So this precisely gives us 
> the pointer we need to point to the PKC of the issuer of the 
> AC in which this extension occurs. 

Identifying a public key is not the same as pointing to a PKC.  The AKID
extension will not do what you seem to want.  It is easy enough to use
id-caIssuers to point to a PKC used to verify an attribute certificate
signature and to define a new access method to point to an attribute
certificate that precedes the attribute certificate containing the extension
in a PMI chain.  Further overloading id-caIssuers, which can already point
to a PKCS7 blob or a cert, to point to attribute certificates is a bad idea,
in my opinion.

> This is in line with its
> current use in PKCs. Thus we do not need the AIA to point to 
> the PKC of the issuer.
> 
> The second point means that we only need to use the AIA to
> point to the AC of the issuer. And caissuers can be used for 
> this unambiguously if we edit the first sentence of its 
> description in 3280-bis. The current wording does in my 
> opinion rule out its use in CRLs. So it would be advantageous 
> to change the wording,regardless of the AC debate.

The wording appears in a section that describes public key certificate
extensions.  Language specific to PKCs in that section does not preclude
language elsewhere that describes how the extension can be used in different
types of objects, such as CRLs or attribute certificates. Ideally, other
usage should be consistent with the RFC3280 usage, i.e., the extension
should be used to point to certs or P7 blobs.