Subject: Re: RFC 3280: same certificate in a certification path

From: [email-masked] (Peter Gutmann)
Date: Fri, 16 May 2003 15:50:58 +1200

Richard Levitte - VMS Whacker <[email-masked]> writes:

>Heh, to forbid those may seem silly, but you have to admit that it gives a
>good hint that "CA1 -> EE" is the better way to go, wouldn't you agree?  Why
>would you at all want to take the longer path?  Or is there some policy magic
>that requires the long path to be processed?

See "Building Certifications Paths: Forward vs. Reverse" from NDSS '01.

Having said that, even trying to work with a PKI in which loops are possible
is about as sound as playing Irish roulette (a variant of Russian roulette in
which you use six bullets and hope the gun jams).  Given the flakiness of
current software in handling even relatively straightforward cert paths,
trying to rely on any kind of consistent behaviour in the face of loops in
paths is practically suicidal, you may as well flip a coin to determine the
outcome.

Peter.

---

From: [email-masked] (Peter Gutmann)
Date: Mon, 19 May 2003 16:00:48 +1200

Eric Norman <[email-masked]> writes:

>Attached is a DER encoded PKCS7 "certs only" blob with two CAs that have
>mutually signed for each other.  Does that help?  I know it's not everything
>you're looking for.  I suppose I can make more if we're on the right track
>here.

Hmm, interesting.  I'm on a minimally-configued Windows box at the moment so I
can't feed it to too many things, but Windows displays this as CA1 -> CA2 ->
CA1 and can't verify it because the issuer of the first instance of CA1 can't
be found.  Mozilla hands it off to Windows, with the same result (hmm, it can
import certs but apparently not full chains).  cryptlib sees CA1 -> CA2 (or
CA2 -> CA1, it uses hinting to determine the leaf cert, e.g. the
issuerAndSerialNumber in the signed data, if there's no hint available it
canonicalises the certs into a chain and takes the leaf as the first leaf-
candidate it finds) and validates it once you mark the root as trusted.

Could you do one with an alternating sequence of CA1 and CA2?  I'd be
interested in seeing what response that produces.

Peter.