[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: X.509, PKIX, and pathLenConstraint



Title: RE: X.509, PKIX, and pathLenConstraint

I can't help thinking this is getting much more complicated than it needs to or that the discussion needs to be split into two threads, one on path length constraints and the other on CRL-issuers.

First, there IS a definition of what a CA is (X.509 clause 3.3.16. It is "An authority trusted by one or more users to create and assign public-key certificates. Optionally the certification authority may create the users' keys."

A CA also has responsibility for certificate revocation , but can delegate that to another authority, or delegate the task of making revocation status information available (e.g. an OCSP responder)as per the 509 quotes David C passed along. That is the reason that the X.509 text now uses the term CRL-issuer pretty much throughout when it talks about an entity that issues a CRL.

In the path validation process, from a path length constraints standpoint it should make no difference what the final cert is used for, nor does it matter what type of data was signed with the certified key. The constraint on the path is still the same. The final cert and the one containing the constraint do not count against the constraint. Is that point agreed? I want to separate these so I'll know if the DR is ok to progress.

On the other issue of who issues CRLs, if the CA that issued the certificate doesn't do it, then it is the responsibility of that CA to indicate the responsible authority (as per the 509 quotes from David C), however an entity that does not issue certificates is not a CA. Having said that, I'm not convinced that at least for path validation reasons we need yet another term.

Sharon