RE: Problem with draft-ietf-pkix-authorityclearanceconstraints-02

["Santosh Chokhani" <[e-mail]>]

No objection.
 
Steve can direct us to change this now or later since the current text
is unlikely to lead some one astray.


________________________________

	From: [e-mail]
[mailto:[e-mail]] On Behalf Of Stefan Santesson
	Sent: Thursday, April 02, 2009 10:47 AM
	To: Stefan Santesson; IETF-pkix
	Subject: Re: Problem with
draft-ietf-pkix-authorityclearanceconstraints-02
	
	
	Small correction,
	
	I copied the text from the wrong draft, as you may see from the
old title.
	
	The actual text from
draft-ietf-pkix-authorityclearanceconstraints-02 Is almost the same and
has the same problem:
	
	  When processing Authority Clearance Constraints certificate
extension
	   for the purposes of validating Clearance attribute in the end
PKC,
	   the processing described in this section or an equivalent
algorithm
	   MUST be included in the certification path validation.  The
	   processing is presented as additions to the certification
path
	   validation algorithm described in section 6 of [RFC5280].
	
	
	
	This is just a nit that could be fixed at any later update. I
would suggest the following small change:
	
	
	   When processing Authority Clearance Constraints certificate
extension
	   for the purposes of validating Clearance attribute in the end
PKC,
	   the processing described in this section or an equivalent
algorithm
	   MUST be performed in addition to the certification path
	   validation algorithm described in section 6 of [RFC5280].
	
	
	
	/Stefan
	
	
	
	On 4/2/09 2:10 PM, "Stefan Santesson" <[e-mail]>
wrote:
	
	

		I found a problem with
draft-turner-caclearanceconstraints-02.txt
		
		Section 4.1.1. Certification Path Processing  states
		
		  When processing Authority Clearance Constraints
certificate extension
		   for the purposes of validating Clearance attribute in
the end certificate, PKC,
		  the processing described in this section or an
equivalent algorithm
		   MUST be included in the certification path
validation.
		
		It is problematic, and unnecessary to require ca
clearance constraints processing to be "included" in certification path
validation.
		None of the clearance constraints information is needed
to determine the validity of the certificate, and as such it does not be
processed as an integrated process.
		
		It would be perfectly valid for an application who
choose to rely on the clearance information, to process clearance
constraints as a post process, i.e. after path validation is completed.
		
		A requirement to integrate caclearance constraints into
path validation would make this a lot harder to implement as it would
require modification to core security components.
		
		Stefan Santesson
		AAA-sec.com