Subject: RE: Terminology question: "root CA"

From: Andrew Probert <[email-masked]>
Date: Thu, 28 Jan 1999 09:46:43 +1100

I think if its a CA this should still be stated, rather than introduce a new
term of trust anchor.

I would add a definition to PKIX : - root CA .. indicates a self-signed
certficate at the top of a trust hierarchy, which may 
have a number of subordinate CA certficates or cross-certified certficates.

Then change the paragraph in question by deletion of the word 'root'.

	" We use the term "CA" to indicate a CA that is directly trusted by
an end entity; that is, securely acquiring the value of a root CA public key
requires some out-of-band step(s).(See section 1.2.2, "Certification
Authority".)

Andew Probert
Rotek Consulting   http://www.rotek.com.au
a Division of Secure Network Solutions
Tel  +61 3 9690 8877
Fax +61 3 9690 8171

> -----Original Message-----
> From:	Al Arsenault [SMTP:[email-masked]]
> Sent:	Thursday, January 28, 1999 6:14 AM
> To:	[email-masked]
> Cc:	[email-masked]
> Subject:	Terminology question:  "root CA"
> 
> Okay, time to resolve a conflict in terminology:
> 
> PKIX-1, the Cert & CRL profile,  implicitly uses "root CA" to indicate the
> CA at the top of a hierarchy (see Section 6, "Certificate Path
> Validation").  CMP, on the other hand, explicitly states:
> 
> 	" We use the term "root CA" to indicate a CA that is directly
> trusted by
> an end entity; that is, securely acquiring the value of a root CA public
> key requires some out-of-band step(s). This term is not meant to imply
> that
> a root CA is necessarily at the top of any hierarchy, simply that the CA
> in
> question is trusted directly."  (See section 1.2.2, "Certification
> Authority".)
> 
> In the original draft of the Roadmap, we used the term 'root CA' to
> indicate the top of a hierarchy - possibly, a hierarchy of one CA.  It was
> pointed out that this was inconsistent with CMP.  So - what do we do to
> fix
> it in the next draft, especially given the apparent conflict between the
> two soon-to-be RFC's pointed out above?
> 
> My personal preference is to point out the conflict somewhere in the
> Roadmap, and to use "root CA" to indicate the top of a hierarchy, and
> "trust anchor" to indicate the node that is trusted directly.  I'm
> soliciting other suggestions, though.
> 
> Thanks for any inputs,
> 
> 			Al Arsenault
> 
> 
> -- these are my opinions only. They do not necessarily reflect the 
> opinions of my employer, or of any other organization with which I have a 
> relationship.
> 
>

---

From: Warwick Ford <[email-masked]>
Date: Fri, 29 Jan 1999 07:00:56 -0800

Al:

I have always viewed it this way.  In PKIX, "root CA" is a term that is
relative to a relying party -- not a subscriber nor PKI community.  A root
CA is a CA whose public key is trusted a priori to validation of a
certificate chain.  (Such a root CA will often have a self-signed
certificate but other ways of distributing a root CA public key are not
precluded.) We explicitly agreed in the early stages of the PKIX project
that the structuring of CAs in the overall PKI is not restricted to a
hierarchy and can, from the PKIX profile perspective, be any arbitrary
structure.  For that reason we don't recognize the concept of "root of a
hierarchy" in PKIX.

Of course, in practice, PKIs are almost always structured as hierarchies (or
sets of hierarchies), and a relying party will trust, as its root CAs,
either CAs at the apexes of hierarchies or possibly a local CA which issues
certificates to CAs at the apexes of hierarchies.

I don't see how any of the PKIX documents are consistent with this view.

Warwick

> From: Al Arsenault [mailto:[email-masked]]
> Sent: Thursday, January 28, 1999 6:04 AM
> To: [email-masked]; Bill Burr; Brian Korver; Arnoud Galactus
> Engelfriet; ietf-pkix
> Subject: Re: Terminology question: "root CA"
> 
> 
> Folks,
> 
> 	Okay, let me try to clarify with a scenario:
>

---

From: Warwick Ford <[email-masked]>
Date: Fri, 29 Jan 1999 14:38:37 -0800

An unfortunate typo in my final line -- "consistent" should have been
"inconsistent" -- i.e., I am unconvinced there is a problem with the
standards.

Warwick

-----Original Message-----
From: Warwick Ford [mailto:[email-masked]] 
Sent: Friday, January 29, 1999 7:01 AM
To: Al Arsenault; ietf-pkix
Subject: RE: Terminology question: "root CA"

Al:

Warwick