Subject: [pkix] Basic path validation algorithm - policy mapping extension in the target certificate

From: Vangelis Karatsiolis <[email-masked]>
Date: Thu, 08 Oct 2009 11:04:38 +0200

Dear PKIX working group,

while I was teaching the basic path validation algorithm of RFC 5280 to 
the class, one student
came up with the following example. Imagine the target certificate is a 
CA certificate which has
a policy mapping extension in which anyPolicy does appear as 
issuerDomainPolicy or
subjectDomainPolicy. In this case the algorithm does not recognise that 
and does not terminate.
This is because the verification is done in step 6.1.4(a) which is not 
executed when the algorithm
is found in the last certificate in the chain.

Two solutions may be adequate and would recognise this.

1) Copy step 6.1.4(a) to the Wrap-Up procedure

2) Move step 6.1.4(a) to the Basic Certificate Processing

adding the appropriate terminate conditions. What is your opinion on this?

Best Regards,

Vangelis

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Thu, 08 Oct 2009 11:55:46 +0200

Vangelis Karatsiolis wrote:
> issuerDomainPolicy or subjectDomainPolicy.

This is forbidden :
    [...] Policies MUST NOT be mapped either to or from the
    special value anyPolicy (Section 4.2.1.4).

> the algorithm does not recognise that and does not terminate

You just need to add a check for this case and exit in error if it happens.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 8 Oct 2009 07:05:15 -0400

You should not have a failure due to policy mapping extension.

I assume, by target certificate you mean the last certificate.

The policy mapping from last certificate should not come into play.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Jean-Marc Desperrier
> Sent: Thursday, October 08, 2009 5:56 AM
> To: Vangelis Karatsiolis; [email-masked]
> Subject: Re: [pkix] Basic path validation algorithm - policy 
> mapping extension in the target certificate
> 
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>