RE: CA vs. EE cert processing

[Alan Lloyd <Alan.Lloyd@xxxxxxxxxxxxxxxxxxxx>]

Russ.

I aboslutely agree that the Profile should say that if the Ext BC is not
there OR it is there with a NULL then its an EE cert - but this does not
text define usage - which is the critical part.

And the SHALL NOT bit and the fuzzy words of 2119 just leave curiosity.

It would be nice if the para with SHALL NOT in is replaced with words
like.
"If the BC extension is not present or set to a NULL then the
certificate belongs to an EE and MUST NOT be used by the certificate
using system to verify the signature of a certificate." 

All done, precise, no indirection to other text which is fuzzy.

regards alan

----------
From: Russ Housley
To: ietf-pkix@imc.org
Sent: 4/16/99 4:32:32 AM
Subject: RE: CA vs. EE cert processing

I have kept quiet on this thread.  I cannot hold it in any longer.

RFC 2459 has no ambiguity in this area.  If basicConstraints is present,
then the cA boolean tells whether the certificate belongs to a CA or an
EE.
 If basicConstraints is absent, then the certificate belongs to an EE.
Period.

If an implementor wishes to support other profiles in addition to RFC
2459,
then the logic may be more complex.  Fine.  This was a market choice
made
by the implementor.

I do not think that RFC 2459 should be altered to make support for
multiple
profiles easier.

Russ