Subject: Re: SkipCerts Question [RFC3280]

From: Santosh Chokhani <[email-masked]>
Date: Fri, 21 Feb 2003 04:47:00 -0500

Kozo and Russ:

Both of your e-mails are ambiguous to me.

Let me try to provide a clear answer and hopefully it will relate 
to the question being asked.

1.  For require explicit policy, the skipCerts starts applying to 
the certificate in which the value is asserted.  3280 is in contradiction 
in this area with X.509.  The reason it was done is so that in a 
case where trust anchor issues end entity certificates, the infrastructure 
can control turning on of this feature.

2.  DFor requireExpliclityPolicy once a value of zero is reached,
requires a common policy in each certificate (taking policy mapping 
into consideration).  Furthermore, if user initializes the path validation 
with one or more policies (other than anyPolicy), at least one of 
the user policies must appear in each certificate (again taking policy 
mapping into consideration).

3.  3280 is incomplete in the area of processing requireExplicitPolicy 
related stuff.  Specifically, it does not define how there is policy 
failure due to the requireExplicitPolicy being set.

In Kozo's scenario, cert2 need not have requireExplicitPolicy field.
But, since skipCert applies to cert1, by the time cert2 is processed,
requireExplicitPolicy flag is set and all three certiifcates cert0,
cert1, and cert2 must have at least one common policy asserted. 
In addition, if user initialized the path processing with some explicit 
policy(s), at least one of those policies must be common to all three 
certificates.

Any other interpretation by 3280 makes 3280 inconsistent with X.509 
in the area of policy processing.

At Thursday, 20 February 2003, Russ Housley <[email-masked]> 
wrote:

>Kozo:
>
>You understand correctly --  cert2 is not required to have an explicit 
policy.
>
>Russ
>
>At 07:45 PM 2/17/2003 +0900, [email-masked] wrote:
>
>>Dear all,
>>
>>We are now testing our certificate path validation
>>program in Japan.
>>And I have a question on the "SkipCerts" in the RFC3280.
>>
>>Would you please tell me?
>>
>>-----
>>According to the RFC3280,
>>
>>4.2.1.12  Policy Constraints
>>
>><snip>
>>
>>If the requireExplicitPolicy field is present, the value of
>>requireExplicitPolicy indicates the number of additional certificates
>>that may appear in the path before an explicit policy is required for
>>the entire path.
>>-----
>>
>>If there is a certificate path like the following,
>>   cert0
>>   cert1
>>   cert2
>>
>>and if the cert1 has the requireExplicitPolicy=1,
>>
>>is the cert2 required to have an explicit policy or not ?
>>
>>(Is the value applied to the cert1
>>  which has the requireExplicitPolicy=1?)
>>
>>I don't think the cert2 is required to have it,
>>but I'm not sure.
>>
>>Regards,
>>  Kozo
>>--------------------------------------------------------
>>Kozo FUJINO (TEL: +81-82-264-8544  FAX: +81-82-264-8549)
>>NEC System Technologies, Ltd.
>>Hiroshima, Japan
>

---

From: "InKyoung Jeun" <[email-masked]>
Date: Mon, 24 Feb 2003 09:17:49 +0900

-----Original Message-----
From: InKyoung Jeun [mailto:[email-masked]] 
Sent: Friday, February 21, 2003 1:22 PM
To: 'Russ Housley'; [email-masked]'; [email-masked]'
Subject: RE: SkipCerts Question [RFC3280]

Russ :

I think cert2 is required to have an explicit policy.
In the RFC3280 Basic Path validation, if i is equal to n, perform the
wrap-up steps. 
Cert2 is n=i=2, so we must perform the wrap-up steps. During wrap-up
steps, state variable explicit_Policy is set to 0. 
Because if cert2 is not self-issed and explicit policy is 1.

Let's look at the result.
If cert2 has not an explicit policy, valid_policy_tree in NULL and
explicit_policy is 0. And the path processing has failed. So cert2 is
required to have an explicit policy.

Kyoung.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Russ Housley
Sent: Friday, February 21, 2003 8:42 AM
To: [email-masked]; [email-masked]
Subject: Re: SkipCerts Question [RFC3280]

Kozo:

Russ