RE: Son of RFC3280 path validation rules

["Santosh Chokhani" <[e-mail]>]

Steve,

Text has already been written and briefed to the PKIX group as early as
November 2004.  See the slides and minutes from Nov 2004 IETF in
Washington DC

-----Original Message-----
From: [e-mail] [mailto:[e-mail]]
On Behalf Of Stephen Farrell
Sent: Friday, October 20, 2006 5:44 AM
To: Denis Pinkas
Cc: [e-mail]
Subject: Re: Son of RFC3280 path validation rules



Hi Denis,

Denis Pinkas wrote:

> ...the sentence : "The trust anchor for the certification path
> MUST be the same as the trust anchor used to validate the target
certificate" does not allow 
> to address the cases where:

As it happens I disagree with you but that was done to death on the
list before I think.

> 
>      a) two CAs in different branches of a certification tree would
have the same DN, and
> 
>      b) two CAs in different trees of a certification forest would
have the same DN.
> 
> Dave, the text of son-of-RFC328 is currently insufficient to enable
secure implementations.

That strikes me as a wild overstatement almost akin to saying that
we should spend forever figuring out how to handle cases where two
CAs end up with the same private key and never mind making any
progress in the meantime.

I think the current text is fine, an improvement on 3280, and well
worth proceeding with.

I suggest that you write up a separate document that says how to
handle the corner cases above.

Stephen.