Subject: Re: 3280 Bis: Initial Values for Permitted and Excluded Subtrees

From: "David A. Cooper" <[email-masked]>
Date: Wed, 04 Oct 2006 15:15:28 -0400

While I can see that it may be useful in some circumstances to impose a 
path length constraint as an input, I would be inclined to vote against 
including it in section 6.1.1.  Up until now, section 6.1.1 has not 
included any inputs that were not already in X.509's path validation 
algorithm.

What I have done for the moment is to replace the text in section 6.2 
that indicates that it is acceptable for an implementation to apply name 
constraints to a trust anchor with text that says that an implementation 
may apply a path length constraint.  The second paragraph of section 6.2 
now begins as follows:

      An implementation MAY augment the algorithm presented in section 6.1
      to further limit the set of valid certification paths that begin with
      a particular trust anchor.  For example, an implementation MAY modify
      the algorithm to apply a path length constraint to a specific trust
      anchor during the initialization phase, ....

Dave

Tom Gindin wrote:
>         Santosh:
>
>         I see uses for a general RP in setting max_path_length to 0.  It 
> trusts a given CA to issue EE certificates, but refuses to accept cross 
> certificates.  The most obvious scenario where this is useful is if you 
> are trusting an organization's internal CA to issue certificates to 
> employees or members, but you don't have any use for its cross 
> certificates.
>         I suppose there might be some conditions under which setting it to 
> 1 makes sense, since that effectively sets a path length constraint on a 
> CA which doesn't use them itself, but I have never come up with a good 
> scenario for it.
>
>                 Tom Gindin
>
>
>
>
> "Santosh Chokhani" <[email-masked]> 
> 09/16/2006 10:01 PM
>
> To
> Tom Gindin/Watson/IBM@IBMUS
> cc
> "David A. Cooper" <[email-masked]>, "pkix" <[email-masked]>
> Subject
> RE: 3280 Bis: Initial Values for Permitted and Excluded Subtrees
>
>
>
>
>
>
> Tom,
>
> I can see the path length usefulness (specifically path length = 0)when
> a CA is validating one of its trusted operator certificates.
>
> Do you see other usage of setting the value (to 0 or some non-zero)
> value.
>
> -----Original Message-----
> From: Tom Gindin [mailto:[email-masked]] 
> Sent: Saturday, September 16, 2006 5:57 PM
> To: Santosh Chokhani
> Cc: David A. Cooper; pkix
> Subject: RE: 3280 Bis: Initial Values for Permitted and Excluded
> Subtrees
>
>         I'm for this too.  Does including max_path_length make sense as 
> well?  I believe that it does.  Setting it to 0, in particular, trusts a
>
> CA to issue end-entity certificates without trusting it to issue cross 
> certificates.
>
>                 Tom Gindin