Subject: [pkix] Two results when explicit-policy-indicator is set

From: "Peter Rybar" <[email-masked]>
Date: Tue, 19 Mar 2013 11:13:36 +0100

Dear All,

I would like to ask you, where are defined in some sub-clauses of  Clause 6 "Certification Path Validation" of RFC 5280 the final steps of certificate policy processing which are equivalent to steps defined in the Clause 10.5.4 "Final processing" in "Certification path processing procedure" of ITU-T Rec. X.509 (11/2008)?

http://www.itu.int/rec/T-REC-X.509-200811-I/en

10.5.4 Final processing of ITU-T Rec. X.509

"

a) Determine the authorities-constrained-policy-set from the authorities-constrained-policy-set table. If the table is empty, then the authorities-constrained-policy-set is the empty or null set. If the authorities-constrained-policy-set[0, path-depth] is any-policy, then the authorities-constrained-policy-set is any-policy. Otherwise, the authorities-constrained-policy-set is, for each row in the table, the value in the left-most cell which does not contain the identifier any-policy.

b) Calculate the user-constrained-policy-set by forming the intersection of the authorities-constrained-policy-set and the initial-policy-set. 

c) If the explicit-policy-indicator is set, check that neither the authorities-constrained-policy-set nor the user-constrained-policy-set is empty.

"

According to ITU-T Rec. X.509 we have two results when explicit-policy-indicator is set:

authorities-constrained-policy-set

user-constrained-policy-set

Are also defined such results in RFC 5280 and where?

Peter Rybar
National Security Authority
Information Security and Electronic Signature Department

Budatinska 30, 850 07 Bratislava 57, Slovak Republic
tel.: +421 2 6869 2163
mob.: +421 902 891 155
fax: +421 2 6869 1701
e-mail: [email-masked]
e-mail: [email-masked]

---

From: Bilal Ashraf <[email-masked]>
Date: Tue, 19 Mar 2013 16:23:57 +0500

Hi,

In RFC 5280, section 6.1.5. Wrap-Up Procedure, before computation of 
6.1.5 (g), the value of valid_policy_tree is basically the 
authorities-constrained-policy-set. After intersection of 
valid_policy_tree (i.e. authorities-constrained-policy-set) with the 
user-initial-policy-set in 6.1.5 (g), the resultant value will be 
user-constrained-policy-set.

Hope this works.

Regards,
Bilal.

On 3/19/2013 3:13 PM, Peter Rybar wrote:
>
> Dear All,
>
> I would like to ask you, where are defined in some sub-clauses of 
>  Clause 6 "Certification Path Validation" of RFC 5280 the final steps 
> of certificate policy processing which are equivalent to steps defined 
> in the Clause 10.5.4 "Final processing" in "Certification path 
> processing procedure" of ITU-T Rec. X.509 (11/2008)?
>
> a) Determine the authorities-constrained-policy-set from the 
> authorities-constrained-policy-set table. If the table is empty, then 
> the authorities-constrained-policy-set is the empty or null set. If 
> the authorities-constrained-policy-set[0, path-depth] is any-policy, 
> then the authorities-constrained-policy-set is any-policy. Otherwise, 
> the authorities-constrained-policy-set is, for each row in the table, 
> the value in the left-most cell which does not contain the identifier 
> any-policy.
>
> b) Calculate the user-constrained-policy-set by forming the 
> intersection of the authorities-constrained-policy-set and the 
> initial-policy-set.
>
> c) If the explicit-policy-indicator is set, check that neither the 
> authorities-constrained-policy-set nor the user-constrained-policy-set 
> is empty.
>
> "
>
> e-mail: [email-masked] <mailto:[email-masked]>
> e-mail: [email-masked] <mailto:[email-masked]>
>
>
>
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix