Re: basic constraints?

[dpkemp@xxxxxxxxxxxxxx (David P. Kemp)]

The X.509 documentation is clear on this, but it hasn't been copied or
paraphrased into PKIX yet.

  "The pathLenConstraint component shall be present only if cA is set to
  true. It gives the maximum number of CA-certificates that may follow
  this certificate in a certification path. Value 0 indicates that the
  subject of this certificate may issue certificates only to end-entities
  and not to further CAs. If no pathLenConstraint field appears in any
  certificate of a certification path, there is no limit to the allowed
  length of the certification path."


That said, the BasicConstraints extension is (IMO) an example of needless
complexity.  It is defined as:

  BasicConstraints ::= SEQUENCE {
      cA                 BOOLEAN DEFAULT FALSE,
      pathLenConstraint  INTEGER (0..MAX) OPTIONAL }


where it could have been defined much more simply as:

  BasicConstraints ::= INTEGER (0..MAX)

with the integer representing the total number of certs (including the
leaf) that may follow this certificate in the certification path.  I.e.
0 indicates not-a-CA, 1 indicates only end-entity certs may be issued,
2 indicates only one CA may follow, etc.

This is one example (the AuthorityKeyIdentifier extension is a more
egregious one) where I agree with the SPKI criticism that the use of
ASN.1 seduces designers into unnecessarily obtuse constructs.