Re: Problem with draft-ietf-pkix-authorityclearanceconstraints-02

[Stefan Santesson <[e-mail]>]

Small correction,

I copied the text from the wrong draft, as you may see from the old title.

The actual text from  draft-ietf-pkix-authorityclearanceconstraints-02 Is
almost the same and has the same problem:

   When processing Authority Clearance Constraints certificate extension
   for the purposes of validating Clearance attribute in the end PKC,
   the processing described in this section or an equivalent algorithm
   MUST be included in the certification path validation.  The
   processing is presented as additions to the certification path
   validation algorithm described in section 6 of [RFC5280].



This is just a nit that could be fixed at any later update. I would suggest
the following small change:


   When processing Authority Clearance Constraints certificate extension
   for the purposes of validating Clearance attribute in the end PKC,
   the processing described in this section or an equivalent algorithm
   MUST be performed in addition to the certification path
   validation algorithm described in section 6 of [RFC5280].



/Stefan



On 4/2/09 2:10 PM, "Stefan Santesson" <[e-mail]> wrote:

> I found a problem with draft-turner-caclearanceconstraints-02.txt
> 
> Section 4.1.1. Certification Path Processing  states
> 
>    When processing Authority Clearance Constraints certificate extension
>    for the purposes of validating Clearance attribute in the end certificate,
> PKC,
>    the processing described in this section or an equivalent algorithm
>    MUST be included in the certification path validation.
> 
> It is problematic, and unnecessary to require ca clearance constraints
> processing to be ³included² in certification path validation.
> None of the clearance constraints information is needed to determine the
> validity of the certificate, and as such it does not be processed as an
> integrated process.
> 
> It would be perfectly valid for an application who choose to rely on the
> clearance information, to process clearance constraints as a post process,
> i.e. after path validation is completed.
> 
> A requirement to integrate caclearance constraints into path validation would
> make this a lot harder to implement as it would require modification to core
> security components.
> 
> Stefan Santesson
> AAA-sec.com
> 
> 
> 
>