Re: I-D ACTION:draft-ietf-pkix-certpathbuild-00.txt

["Wen-Cheng Wang" <wcwang@xxxxxxxxxx>]

> 
> 1. path building over http
> 
[snip]
> IMHO, path building over http may be achieved using cAIssuers
> accessMethod in AIA extension, but it only describes single path like
> strict hierarchy.
Not exactly so, if we let caIssuers accessMethod be a HTTP URI points
to a PKCS#7 wrapped certificate list which contains all cross-certificates
issued to the issuer of the nominated certificate, there is no problem to
traverse the whole cross-certification network. However, AIA-assisted
path building only supports forward direction (I mean "from the target
certificate to a trusted root" as defined by the draft.).

-----
Wen-Cheng Wang
Project Researcher
Telecommunication Laboratories
Chunghwa Telecom Co., Ltd