Re: [saag] height of PKI

[Viktor Dukhovni <[e-mail]>]

On Tue, Aug 25, 2020 at 11:14:24PM -0400, Michael Richardson wrote:

> On 2020-07-28 3:42 p.m., Benjamin Kaduk wrote:
> > Sorry for the clumsy description.  Basically, if you squint hard, you could
> > claim that at least some types of pinning are actually a PKI, just a
> > degenerate PKI.  E.g., in a PKI I have to pin at least one trust anchor as
> > the root of the PKI, and if that pinned trust anchor just happens to also
> > be the certificate directly used in the protocol, it's still a PKI, just a
> > tree of height one.
> 
> I had suggested that a PKI that consisted of ROOT, Intermediate, and EE
> had a height of "three".
> Some disagreed, and said that the EE didn't count, and it was a height 
> of "two"
> Others disagreed: the EE counts, but the root doesn't count, so it's a 
> height of "two"
> 
> So is your case above a height of "one", or a height of "zero"
> 
> If there is a definitive answer, I haven't found it yet.

What's "definitive"?  And which certificate is at depth 0, the root or
the leaf?  These questions have no answer (different X.509 libraries
answer them differently), just be clear about your notation in context.

You could of course go with RFC5280, but its numbering is by no means
universally used.

-- 
    Viktor.