Subject: Re: RFC 3280: same certificate in a certification path

From: [email-masked] (Peter Gutmann)
Date: Sun, 18 May 2003 17:38:19 +1200

Eric Norman <[email-masked]> writes:

>In fact, the examples chosen here, e.g. the path segment CA1 -> CA2 -> CA1
>(append another -> CA2 if you prefer) are precisely what happens when two CAs
>cross certify each other by signing each others keys (really attesting to
>each other's identity) and then publish the fact that they have done so with
>a CrossCertificatePair with both parts filled in (e.g. bridge stuff and the
>like).

Does anyone have some cert chains (PKCS #7) with these kinds of
characteristics?  It'd be nice to have some test vectors for this sort of
thing (with a few variations, e.g. CA1 -> CA2 -> CA1, CA1 -> CA2 -> CA1 -> CA2
-> CA1 -> CA2, CA1 -> CA2 -> CA2 -> CA2) to play with, but without a lot of
custom hacking it would be quite difficult to create with the tools I have now
(they simply won't allow something like this, for the reasons I gave earlier).

Peter.

---

From: Eric Norman <[email-masked]>
Date: Sun, 18 May 2003 21:13:54 -0500 (CDT)

> (they simply won't allow something like this, for the reasons I gave earlier).

Attached is a DER encoded PKCS7 "certs only" blob with two CAs that
have mutually signed for each other.  Does that help?  I know it's
not everything you're looking for.  I suppose I can make more if
we're on the right track here.

Eric Norman

	"Congress shall make no law restricting the size of integers
	that may be multiplied together, or the number of times that
	an integer may be multiplied by itself, or the modulus by
	which an integer may be reduced".