Re: [IETF-PKIX] Dave's Critical Proposal

[John Pawling <jsp@xxxxxxxxxxxxx>]

Dave,

X.509, Sec 12.4.3, certificate check, bullet 6 states:
"d) If the certificate policies extension is present and is flagged
critical, compute the intersection of the policies in that extension and the
authority-constrained-policy-set and put the result as the new value of
authority-constrained-policy-set. Check that the intersection of
authority-constrained-policy-set and user-constrained-policy-set is non-empty."

You proposed adding the following statement to PKIX I:
>  "If an implementation recognizes the syntax of a particular extension,
>   the value of the critical boolean in that extension SHALL be ignored."

If certificate-processing software followed your proposed rule, then it
wouldn't be allowed to use the value of the certificate policies extension
critical flag as part of the certification path validation process specified
in X.509, Sec 12.4.3.  Therefore, your statement is contradictory to X.509
and should not be added to PKIX I.

================================
John Pawling
jsp@jgvandyke.com
J.G. Van Dyke & Associates, Inc.
================================