Subject: RE: Son of RFC3280 path validation rules

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 20 Oct 2006 04:41:57 -0700

Steve,

Writing an I-D will be a breeze.  But, when I briefed the stuff in 2004,
there was no support for doing this.

-----Original Message-----
From: Stephen Farrell [mailto:[email-masked]] 
Sent: Friday, October 20, 2006 7:39 AM
To: Santosh Chokhani
Cc: Denis Pinkas; [email-masked]
Subject: Re: Son of RFC3280 path validation rules

Hi Santosh,

That's true. What I meant however, was an I-D. If no-one wants to
write one then maybe this isn't actually such a pressing problem.

S.

Santosh Chokhani wrote:
> Steve,
> 
> Text has already been written and briefed to the PKIX group as early
as
> November 2004.  See the slides and minutes from Nov 2004 IETF in
> Washington DC
> 
> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Stephen Farrell
> Sent: Friday, October 20, 2006 5:44 AM
> To: Denis Pinkas
> Cc: [email-masked]
> Subject: Re: Son of RFC3280 path validation rules
> 
> 
> 
> Hi Denis,
> 
> Denis Pinkas wrote:
> 
>> ...the sentence : "The trust anchor for the certification path
>> MUST be the same as the trust anchor used to validate the target
> certificate" does not allow 
>> to address the cases where:
> 
> As it happens I disagree with you but that was done to death on the
> list before I think.
> 
>>      a) two CAs in different branches of a certification tree would
> have the same DN, and
>>      b) two CAs in different trees of a certification forest would
> have the same DN.
>> Dave, the text of son-of-RFC328 is currently insufficient to enable
> secure implementations.
> 
> That strikes me as a wild overstatement almost akin to saying that
> we should spend forever figuring out how to handle cases where two
> CAs end up with the same private key and never mind making any
> progress in the meantime.
> 
> I think the current text is fine, an improvement on 3280, and well
> worth proceeding with.
> 
> I suggest that you write up a separate document that says how to
> handle the corner cases above.
> 
> Stephen.
> 
> 
> 
> 
>

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 20 Oct 2006 13:04:39 +0100

Santosh Chokhani wrote:
> Steve,
> 
> ... when I briefed the stuff in 2004,

Exactly.

We should push 3280 bis out the door now.

S.

---

From: "Michael Myers" <[email-masked]>
Date: Fri, 20 Oct 2006 05:39:01 -0800

I concur.

Mike

-----Original Message-----
From: Stephen Farrell
Sent: Friday, October 20, 2006 4:05 AM
> . . .