[keyassure] End entity certificate matching, trust anchors, and protocol-06

[Paul Hoffman <[e-mail]>]

Greetings again. Draft -06 has two major changes, mandatory-to-implement 
algorithms and revised semantics for End entity certificate matching and 
trust anchors. The first is fairly straight-forward and hopefully 
exactly what was prescribed for the resolution to now-closed issue #21.

The second is more problematic, which is reflected in the fact that 
there is now much more text. Please read the new text carefully, 
including the quoted text from RFC 5280. You may be surprised both by 
the restrictions that PKIX puts on us (namely that self-signed 
certificates are always CA certificates) and by the measures suggested 
in -06 (format validation on end entity certificates is relaxed to allow 
self-signed certificates for end entities).

Comments are, of course, welcome. Proposals for new wording if needed 
are even more welcome. If we have made mistakes in reading RFC 5280, 
quoting from that document in your messages will be helpful to the 
entire WG.

We will be presenting on this in Prague, but would love to see 
discussion happen in the weeks before then.

--Paul Hoffman