Subject: RE: Request change in son-of-rfc2633

From: [email-masked] (Peter Gutmann)
Date: Tue, 28 Oct 2003 15:12:25 +1300

"Blake Ramsdell" <[email-masked]> writes:

>Apparently I was one of the deluded folks that believed that SKI was meant to
>be globally unique.

As was almost everyone else.  The problem is that there are two incompatible
interpretations of the sKID:

1. Alternative chaining mechanism if chaining by DN fails, e.g. with cert
   reparenting or some types of spaghetti PKIs.

2. Disambiguating factor if chaining by DN leads to multiple issuers, e.g.
   with other types of spaghetti PKIs.

The problem is that taking one or the other view changes a simple "You've used
the wrong cert" (or "Cert to verify this isn't available") to "An attacker is
modifying your messages!", which will cause very different reactions in users.

Peter.

---

From: "Blake Ramsdell" <[email-masked]>
Date: Mon, 27 Oct 2003 18:25:36 -0800

> -----Original Message-----
> From: Peter Gutmann [mailto:[email-masked]] 
> Sent: Monday, October 27, 2003 6:12 PM
> To: [email-masked]; [email-masked]; 
> [email-masked]
> Cc: [email-masked]
> Subject: RE: Request change in son-of-rfc2633
> 

Yeah, I'm with you, so the "discuss the implications of this" that I
mentioned would need to cover behavior when presented with multiple
certificates with the same SKI.

Something like:

"When looking up certificates using the subjectKeyIdentifier field,
S/MIME agents MUST be prepared to handle multiple certificates that have
the same subjectKeyIdentifier value gracefully."

No, that needs a lot of work.  I'll call him a "strawman".

Blake