Subject: [pkix] Tilbagekaldelse: ForwardCertificationPath

From: "Erik Andersen" <[email-masked]>
Date: Fri, 22 Jul 2011 18:12:21 +0200

WARNING: contains banned part

Subject: Tilbagekaldelse: ForwardCertificationPath
From: "Erik Andersen" <[email-masked]>
To: "Directory list" <[email-masked]>, "SG17-Q11" <[email-masked]>, "PKIX" <[email-masked]>
Date: Fri, 22 Jul 2011 18:12:21 +0200

Erik Andersen vil gerne tilbagekalde meddelelsen "ForwardCertificationPath".

---

From: "Charles W. Gardiner" <[email-masked]>
Date: Fri, 22 Jul 2011 17:21:33 -0400

At 12:14 PM 7/22/2011, Erik Andersen wrote:
>Content-Type: multipart/alternative;
>         boundary="----=_NextPart_000_0027_01CC489B.26E11E00"
>Content-Language: da
>
>Sorry for clumsy fingers.
>
>Somewhere in clause 7 of X.509 we have the following ASN.1 with very 
>little explanatory text. Can anyone explain the following:
>
>In addition, the following ASN.1 data type can be used to represent the 
>forward certification path. This component contains the certification path 
>which can point back to the originator.
>
>ForwardCertificationPath  ::=  SEQUENCE OF CrossCertificates
>
>CrossCertificates  ::=  SET OF Certificate
>
>In particular, why is it a SET OF Certificate?

     To indicate they are all at the same level of the hierarchy?  In a 
SEQUENCE the order is significant, but not in a SET.

Charlie Gardiner

>
>
>Erik Andersen
>Andersen's L-Service
>Elsevej 48,
>DK-3500 Vaerloese
>Denmark
>Mobile: +45 2097 1490
>e-amail: <[email-masked]>[email-masked]
>Skype: andersen-erik
><http://www.x500.eu/>http://www.x500.eu/
>http://www.x500standard.com/
><http://dk.linkedin.com/in/andersenerik>http://dk.linkedin.com/in/andersenerik
>
>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix

---

From: Kyle Hamilton <[email-masked]>
Date: Fri, 22 Jul 2011 21:39:25 -0700

> In particular, why is it a SET OF Certificate?
Plausible (to me) explanation (and I have no connection with any of  
the design document requirements, just speculation):

To deal with the situation you find today: that there are many  
independent trust anchors (states), and devices are tied to their own  
state of ownership; so, you need to figure out a way back to your own  
certification hierarchy (in the event of, say, international treaties  
which only exist as long as the government is recognized as a  
legitimate government).  The SET OF Certificate is the set of incoming  
trust certifications that the local trust anchor has.  It may be any  
size, and no state is any greater or lesser than any other in the  
standards.

This is also (if my guess is correct) the original purpose for these  
standards, to facilitate inter-state communications.  The ITU is a  
working arm of the United Nations, and thus simply cannot be  
political.  The goal of the UN is to facilitate and foster  
international community, not cause war by any kind of inter-state  
favoritism reflected in the standards.

The system finally makes logical sense, and has a kind of incredibly  
elegant beauty, when it is viewed from that perspective.  I expect  
that access to the inter-state working group minutes would be  
educational, but they are not available to me.

-Kyle H