Subject: RE: 3280 open issues

From: "Stefan Santesson" <[email-masked]>
Date: Mon, 25 Oct 2004 09:45:00 +0100

More so,

The qualifier set isn't used anywhere either.

Test for criticality is part of 3280 path validation, but as Peter
points out, it doesn't require use of the criticality indicator as part
of the process.

You could in fact create a compliant path validation algorithm by
completely remove the qualifier set and criticality indicator from the
policy tree, which would make the algorithm more clean.

Stefan Santesson
Microsoft Security Center of Excellence (SCOE)
 
> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Peter Sylvester
> Sent: den 22 oktober 2004 17:47
> To: [email-masked]
> Subject: 3280 open issues
> 
> 
> 
> To repeat it:
> 
> The current validation algorith in 3280 contain a table
> 
>               +----------------+
>               |   anyPolicy    |   <---- valid_policy
>               +----------------+
>               |       {}       |   <---- qualifier_set
>               +----------------+
>               |     FALSE      |   <---- criticality_indicator
>               +----------------+
>               |  {anyPolicy}   |   <---- expected_policy_set
>               +----------------+
> 
> but it seems to me that nowhere the criticality_indicator
> is used at all which is normal because treatment is independant
> of that.
> 
> There are several places to copy some value and to set it according
> the criticality of policy mapping but still no usage.
> 
> it seems that this is a left over from a treatment which had been
> abandonned in order to be aligned with an X509 defect report
resolution.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 25 Oct 2004 08:59:38 -0400

I agree on criticality.

As to the qualifiers, they are output for use by the RP (client); they
should be kept in order to comply with X.509

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Stefan Santesson
Sent: Monday, October 25, 2004 4:45 AM
To: Peter Sylvester; [email-masked]
Subject: RE: 3280 open issues

More so,

Test for criticality is part of 3280 path validation, but as Peter points
out, it doesn't require use of the criticality indicator as part of the
process.

You could in fact create a compliant path validation algorithm by completely
remove the qualifier set and criticality indicator from the policy tree,
which would make the algorithm more clean.

Stefan Santesson
 
> is used at all which is normal because treatment is independant of
> that.
> 
resolution.