Subject: RE: AKI and SKI problem with RFC 3280?

From: Sharon Boeyen <[email-masked]>
Date: Wed, 22 Oct 2003 15:45:46 -0400

Now I'm getting confused???

To simplify the discussion....

Shouldn't a CA determine what its own key identifier is (and 3280 recommends
ways to calulate it). One they have their own key id, this value should  
go into the AKI extension of all certificates issued by that CA and should
go 
into the SKI extension of all certificates issued to that CA. When acting 
as the issuer, the CA knows the value and simply populates it. When acting
as 
the subject, the CA should pass the value in the certificate request it
sends 
to the issuing CA and that value should be used by the issuing CA to
populate 
the SKI. If the value is not sent in the cert request, then the issuer CA
needs 
to use other means to determine the correct value for that SKI.

-----Original Message-----
From: Peter Hesse [mailto:[email-masked]]
Sent: Wednesday, October 22, 2003 12:59 PM
To: 'Santosh Chokhani'; [email-masked]
Subject: RE: AKI and SKI problem with RFC 3280?

Santosh Chokhani wrote:
> My e-mail needs to be read in the context of the producers.  
> The CAs as producers need to ensure that the AKI and SKI chain.
> If the CAs do not do that, they are not compliant with 3280.  
> That means in order to comply with 3280 issuing CA needs to 
> honor the SKID requested by the subject CAs.

I think we're in violent agreement.  My main point was that although the
producer needs to ensure that AKID and SKID chain, cross-PKI
interoperability will cause cases in which the producer must choose
between two (or more) equally valid AKIDs to place in a subject
certificate.  Either of them will chain successfully and the producer
will be compliant; but as a result there will be valid paths where the
AKID and SKID will not chain, through no fault of the producer.

--Peter

+---------------------------------------------------------------+
| Peter Hesse                    [email-masked]     |
| Phone: (703)934-2031         Gemini Security Solutions, Inc.  |
| ICQ: 1942828                     www.geminisecurity.com       |
+---------------------------------------------------------------+
"Pay no attention to what the critics say; there has never been 
a statue set up in honor of a critic." --Jean Sibelius

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 22 Oct 2003 19:19:03 -0400

Sharon:

I agree.  What you listed is the simplest way to meet the requirement.

-----Original Message-----
From: Peter Hesse [mailto:[email-masked]]
Sent: Wednesday, October 22, 2003 12:59 PM
To: 'Santosh Chokhani'; [email-masked]
Subject: RE: AKI and SKI problem with RFC 3280?

I think we're in violent agreement.  My main point was that although the
producer needs to ensure that AKID and SKID chain, cross-PKI
interoperability will cause cases in which the producer must choose between
two (or more) equally valid AKIDs to place in a subject certificate.  Either
of them will chain successfully and the producer will be compliant; but as a
result there will be valid paths where the AKID and SKID will not chain,
through no fault of the producer.

--Peter