Re: [keyassure] Bare keys again

[Stephen Kent <[e-mail]>]

At 9:06 PM -0400 3/20/11, Matt McCutchen wrote:
>On Sun, 2011-03-20 at 20:40 -0400, Paul Wouters wrote:
>>  On Sun, 20 Mar 2011, Paul Hoffman wrote:
>>  > If you want to add bare CA keys, that's fine, but I suspect that 
>>you actually want to add bare end entity keys, and RFC 6066 doesn't 
>>allow that.
>>
>>  That difference is muddy anyway, isn't it? Isn't a self-signed 
>>certificate a CA?
>
>It is not used to sign any certificates (except itself, but that is
>irrelevant because no one ever relies on the self signature), so no.

as per the various 580 cites that Paul H. has put in the most recent version
of the DANE spec, an SS cert is a CA cert, irrespective of whether it is
used to verify sigs on other certs.  The one slightly "muddy" 
situation is when an SS cert is used to convey a trust anchor.  A TA 
is a CA in the usual case, but the cert is just a convenient 
container to convey the TA data, so there are no checks (in 5280) 
that are mandated for this case.

Steve