Subject: Problem with draft-turner-caclearanceconstraints-02.txt

From: Stefan Santesson <[email-masked]>
Date: Thu, 02 Apr 2009 14:10:44 +0200

I found a problem with draft-turner-caclearanceconstraints-02.txt

Section 4.1.1. Certification Path Processing  states

   When processing Authority Clearance Constraints certificate extension
   for the purposes of validating Clearance attribute in the end
certificate, PKC,
   the processing described in this section or an equivalent algorithm
   MUST be included in the certification path validation.

It is problematic, and unnecessary to require ca clearance constraints
processing to be ³included² in certification path validation.
None of the clearance constraints information is needed to determine the
validity of the certificate, and as such it does not be processed as an
integrated process.

It would be perfectly valid for an application who choose to rely on the
clearance information, to process clearance constraints as a post process,
i.e. after path validation is completed.

A requirement to integrate caclearance constraints into path validation
would make this a lot harder to implement as it would require modification
to core security components.

Stefan Santesson
AAA-sec.com

---

From: Stefan Santesson <[email-masked]>
Date: Thu, 02 Apr 2009 16:47:00 +0200

Small correction,

I copied the text from the wrong draft, as you may see from the old title.

The actual text from  draft-ietf-pkix-authorityclearanceconstraints-02 Is
almost the same and has the same problem:

   When processing Authority Clearance Constraints certificate extension
   for the purposes of validating Clearance attribute in the end PKC,
   the processing described in this section or an equivalent algorithm
   MUST be included in the certification path validation.  The
   processing is presented as additions to the certification path
   validation algorithm described in section 6 of [RFC5280].

This is just a nit that could be fixed at any later update. I would suggest
the following small change:

   When processing Authority Clearance Constraints certificate extension
   for the purposes of validating Clearance attribute in the end PKC,
   the processing described in this section or an equivalent algorithm
   MUST be performed in addition to the certification path
   validation algorithm described in section 6 of [RFC5280].

/Stefan

On 4/2/09 2:10 PM, "Stefan Santesson" <[email-masked]> wrote:

>    for the purposes of validating Clearance attribute in the end certificate,
> PKC,
> A requirement to integrate caclearance constraints into path validation would
> make this a lot harder to implement as it would require modification to core
> security components.
> 
> Stefan Santesson
> AAA-sec.com
> 
> 
> 
>

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 2 Apr 2009 11:00:46 -0400

No objection.
 
Steve can direct us to change this now or later since the current text
is unlikely to lead some one astray.

________________________________

	From: [email-masked]
[mailto:[email-masked]] On Behalf Of Stefan Santesson
	Sent: Thursday, April 02, 2009 10:47 AM
	To: Stefan Santesson; IETF-pkix
	Subject: Re: Problem with
draft-ietf-pkix-authorityclearanceconstraints-02

	Small correction,
	
	I copied the text from the wrong draft, as you may see from the
old title.
	
	The actual text from
draft-ietf-pkix-authorityclearanceconstraints-02 Is almost the same and
has the same problem:
	
	  When processing Authority Clearance Constraints certificate
extension
	   for the purposes of validating Clearance attribute in the end
PKC,
	   the processing described in this section or an equivalent
algorithm
	   MUST be included in the certification path validation.  The
	   processing is presented as additions to the certification
path
	   validation algorithm described in section 6 of [RFC5280].

	This is just a nit that could be fixed at any later update. I
would suggest the following small change:

	   When processing Authority Clearance Constraints certificate
extension
	   for the purposes of validating Clearance attribute in the end
PKC,
	   the processing described in this section or an equivalent
algorithm
	   MUST be performed in addition to the certification path
	   validation algorithm described in section 6 of [RFC5280].

	/Stefan

	On 4/2/09 2:10 PM, "Stefan Santesson" <[email-masked]>
wrote:

		I found a problem with
draft-turner-caclearanceconstraints-02.txt

		  When processing Authority Clearance Constraints
certificate extension
		   for the purposes of validating Clearance attribute in
the end certificate, PKC,
		  the processing described in this section or an
equivalent algorithm
		   MUST be included in the certification path
validation.
		
		It is problematic, and unnecessary to require ca
clearance constraints processing to be "included" in certification path
validation.
		None of the clearance constraints information is needed
to determine the validity of the certificate, and as such it does not be
processed as an integrated process.
		
		It would be perfectly valid for an application who
choose to rely on the clearance information, to process clearance
constraints as a post process, i.e. after path validation is completed.
		
		A requirement to integrate caclearance constraints into
path validation would make this a lot harder to implement as it would
require modification to core security components.
		
		Stefan Santesson
		AAA-sec.com