Subject: 3280 open issues

From: Peter Sylvester <[email-masked]>
Date: Fri, 22 Oct 2004 17:47:25 +0200 (MEST)

To repeat it:

The current validation algorith in 3280 contain a table

              +----------------+
              |   anyPolicy    |   <---- valid_policy
              +----------------+
              |       {}       |   <---- qualifier_set
              +----------------+
              |     FALSE      |   <---- criticality_indicator
              +----------------+
              |  {anyPolicy}   |   <---- expected_policy_set
              +----------------+

but it seems to me that nowhere the criticality_indicator
is used at all which is normal because treatment is independant
of that. 

There are several places to copy some value and to set it according
the criticality of policy mapping but still no usage.

it seems that this is a left over from a treatment which had been
abandonned in order to be aligned with an X509 defect report resolution.

---

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 27 Oct 2004 13:18:49 +0100

Santosh,

We agree on the facts.

Stefan Santesson
Microsoft Security Center of Excellence (SCOE)

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Santosh Chokhani
> Sent: den 25 oktober 2004 15:00
> To: [email-masked]
> Subject: RE: 3280 open issues
> 
> 
> I agree on criticality.
> 
> As to the qualifiers, they are output for use by the RP (client); they
> should be kept in order to comply with X.509
> 
> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On
> Behalf Of Stefan Santesson
> Sent: Monday, October 25, 2004 4:45 AM
> To: Peter Sylvester; [email-masked]
> Subject: RE: 3280 open issues
> 
> 
> 
> More so,
> 
> The qualifier set isn't used anywhere either.
> 
> Test for criticality is part of 3280 path validation, but as Peter
points
> out, it doesn't require use of the criticality indicator as part of
the
> process.
> 
> You could in fact create a compliant path validation algorithm by
> completely
> remove the qualifier set and criticality indicator from the policy
tree,
> which would make the algorithm more clean.
> 
> Stefan Santesson
> Microsoft Security Center of Excellence (SCOE)
> 
> > -----Original Message-----
> > From: [email-masked]
> [mailto:[email-masked]]
> > On Behalf Of Peter Sylvester
> > Sent: den 22 oktober 2004 17:47
> > To: [email-masked]
> > Subject: 3280 open issues
> >
> >
> >
> > To repeat it:
> >
> > is used at all which is normal because treatment is independant of
> > that.
> >