Re: [saag] height of PKI

[Michael Richardson <[e-mail]>]

Viktor Dukhovni <[e-mail]> wrote:
    >> On 2020-07-28 3:42 p.m., Benjamin Kaduk wrote: > Sorry for the clumsy
    >> description.  Basically, if you squint hard, you could > claim that at
    >> least some types of pinning are actually a PKI, just a > degenerate
    >> PKI.  E.g., in a PKI I have to pin at least one trust anchor as > the
    >> root of the PKI, and if that pinned trust anchor just happens to also
    >> > be the certificate directly used in the protocol, it's still a PKI,
    >> just a > tree of height one.
    >>
    >> I had suggested that a PKI that consisted of ROOT, Intermediate, and
    >> EE had a height of "three".  Some disagreed, and said that the EE
    >> didn't count, and it was a height of "two" Others disagreed: the EE
    >> counts, but the root doesn't count, so it's a height of "two"
    >>
    >> So is your case above a height of "one", or a height of "zero"
    >>
    >> If there is a definitive answer, I haven't found it yet.

    > What's "definitive"?  And which certificate is at depth 0, the root or
    > the leaf?  These questions have no answer (different X.509 libraries
    > answer them differently), just be clear about your notation in context.

I would be interested in which libraries do what.

    > You could of course go with RFC5280, but its numbering is by no means
    > universally used.

Alright.  Let me look again there.

}6.1.  Basic Path Validation
}...
}   To meet this goal, the path validation process verifies, among other
}   things, that a prospective certification path (a sequence of n
}   certificates) satisfies the following conditions:
}
}      (a)  for all x in {1, ..., n-1}, the subject of certificate x is
}           the issuer of certificate x+1;
}
}      (b)  certificate 1 is issued by the trust anchor;
}
}      (c)  certificate n is the certificate to be validated (i.e., the
}           target certificate); and
}
}      (d)  for all x in {1, ..., n}, the certificate was valid at the
}           time in question.

So this means that the trust anchor is at height one.
The End-Entity Certificate is to be counted, and it's a height n.

So, in my example of root, intermediate-CA and EE, the height is three.
Which is what I originally thought.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-