Re: [keyassure] End entity certificate matching, trust anchors, and protocol-06

[Peter Gutmann <[e-mail]>]

Paul Hoffman <[e-mail]> writes:

>You may be surprised both by the restrictions that PKIX puts on us (namely
>that self-signed certificates are always CA certificates) and by the measures
>suggested in -06 (format validation on end entity certificates is relaxed to
>allow self-signed certificates for end entities).

This particular issue has been an ongoing problem for years.  More than a
decade ago I proposed the ability to create straightforward self-issued
certificates:

http://www.cs.auckland.ac.nz/~pgut001/pubs/autonomous.txt

but it was nixed by the PKIX chair with the comment "we're not going to turn
X.509 into PGP".  The need for this is as real as it was ten years ago, but
I'm not sure how to progress it (I was told at the time that it would be seen
by the IETF as falling within PKIX' purview, and they'd never allow it to be
published, which is why I abandoned work on it).

On a more general note, it's not surprising then that the current draft has to 
incorporate wording to say that you have to ignore the PKIX requirements.

Peter.