Re: Son of RFC3280 path validation rules

[Stephen Farrell <[e-mail]>]

Hi Denis,

Denis Pinkas wrote:

> ...the sentence : "The trust anchor for the certification path
> MUST be the same as the trust anchor used to validate the target certificate" does not allow 
> to address the cases where:

As it happens I disagree with you but that was done to death on the
list before I think.

> 
>      a) two CAs in different branches of a certification tree would have the same DN, and
> 
>      b) two CAs in different trees of a certification forest would have the same DN.
> 
> Dave, the text of son-of-RFC328 is currently insufficient to enable secure implementations.

That strikes me as a wild overstatement almost akin to saying that
we should spend forever figuring out how to handle cases where two
CAs end up with the same private key and never mind making any
progress in the meantime.

I think the current text is fine, an improvement on 3280, and well
worth proceeding with.

I suggest that you write up a separate document that says how to
handle the corner cases above.

Stephen.