RE: WG Last Call: Son-of-2459

[David Cross <dcross@xxxxxxxxxxxxx>]

Steve:

->Anyway, since it is clear that not all folks will issue cross certs 
as I suggested, I have to admit to liking the fallback position of 
allowing specification of name constraints as part of the validation 
procedure, on a per trust anchor basis. The main argument I've seen 
is the one that questions whether this should be a user configurable 
parameter, or an administrative parameter, or whether this is a MAY 
(vs. SHOULD/MUST), which allows vendors to ignore the facility 
entirely.

I would strongly disagree against allowing name constraints to be a user
configurable parameter.  This defeats the administrative value and assurance
that name constraints provide.

David B. Cross