Subject: RE: draft-ietf-pkix-rfc3280bis-04.txt

From: "Carl Wallace" <[email-masked]>
Date: Fri, 14 Jul 2006 08:37:29 -0700

> since the syntax of AKID and AIA are both GeneralNames, then 
> it seems obvious to me that a url can be used in both to 
> point to the location where the issuer's cert can be found, 
> as the text in AIA describes. (In fact AIA caIssuers is not 
> really needed is it?)

X.509 states "the authorityCertIssuer, authoritySerialNumber pair can
only be used to provide preference to one certificate over others during
path construction."  This precludes it's use as an alternative to AIA
caIssuers.  
 
> > It is easy enough to use
> > id-caIssuers to point to a PKC used to verify an attribute 
> certificate 
> > signature and to define a new access method to point to an 
> attribute 
> > certificate that precedes the attribute certificate containing the 
> > extension in a PMI chain.
> 
> Sure, this is an alternative way of doing it. We can do this 
> if concensus is that this is the best way

If this comes to a straw poll, mark me down for the option described
above.

---

From: David Chadwick <[email-masked]>
Date: Sun, 16 Jul 2006 23:20:45 +0100

> path construction."  This precludes it's use as an alternative to AIA

My interpretation would be exactly the opposite of yours. This is 
precisely why AKID can be used to find the correct public key 
certificate for path construction, in order to validate the signature on 
the AC.

regards

David

-- 

*****************************************************************
David W. Chadwick, BSc PhD
Professor of Information Systems Security
The Computing Laboratory, University of Kent, Canterbury, CT2 7NF
Tel: +44 1227 82 3221
Fax +44 1227 762 811
Mobile: +44 77 96 44 7184
Email: [email-masked]
Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html
Research Web site: http://sec.cs.kent.ac.uk
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************

---

From: Stephen Kent <[email-masked]>
Date: Mon, 17 Jul 2006 09:53:12 -0400

At 11:20 PM +0100 7/16/06, David Chadwick wrote:
>Carl Wallace wrote:
>>>since the syntax of AKID and AIA are both GeneralNames, then it 
>>>seems obvious to me that a url can be used in both to point to the 
>>>location where the issuer's cert can be found, as the text in AIA 
>>>describes. (In fact AIA caIssuers is not really needed is it?)
>>
>certificate for path construction, in order to validate the 
>signature on the AC.
>
>regards
>
>David

David C,

PKIX has noted on several occasions that AKI is not designed to be 
used to find a cert, but rather is used to disambiguate among 
multiple CA certs that one may encounter in a repository.  The text 
art the beginning of the description of this extension seems pretty 
clear on that:

The authority key identifier extension provides a means of 
identifying the public key corresponding to the private key used to
sign a certificate.  This extension is used where an issuer has 
multiple signing keys (either due to multiple concurrent key pairs or 
due to changeover). 

The first sentence uses the term "identifying" not "locating." I 
think this is an important distinction, one that is reinforced by the 
second sentence.

Steve

---

From: "Peter Rybar" <[email-masked]>
Date: Tue, 18 Jul 2006 08:30:20 +0200

On the page 6, that information might be helpful to imagine when one CA (Green) has more then ONE certificate (crosscertificate) .

http://www.nbusr.sk/NBU_SEP/en_11.php

Peter

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Stephen Kent
Sent: Monday, July 17, 2006 3:53 PM
To: David Chadwick
Cc: Carl Wallace; David A. Cooper; pkix
Subject: Re: draft-ietf-pkix-rfc3280bis-04.txt

	Carl Wallace wrote: 

			since the syntax of AKID and AIA are both GeneralNames, then it seems obvious to me that a url can be used in both to point to the location where the issuer's cert can be found, as the text in AIA describes. (In fact AIA caIssuers is not really needed is it?)

		caIssuers. 

	My interpretation would be exactly the opposite of yours. This is precisely why AKID can be used to find the correct public key certificate for path construction, in order to validate the signature on the AC.
	
	regards

	David

David C,

PKIX has noted on several occasions that AKI is not designed to be used to find a cert, but rather is used to disambiguate among multiple CA certs that one may encounter in a repository.  The text art the beginning of the description of this extension seems pretty clear on that:

The authority key identifier extension provides a means of identifying the public key corresponding to the private key used to
sign a certificate.  This extension is used where an issuer has  multiple signing keys (either due to multiple concurrent key pairs or due to changeover). 

The first sentence uses the term "identifying" not "locating." I think this is an important distinction, one that is reinforced by the second sentence.

Steve