Re: [TLS] Update spec to match current practices for certificate chain order

[Viktor Dukhovni <[e-mail]>]

On Tue, May 12, 2015 at 09:31:15AM -0700, Watson Ladd wrote:

> > FWIW, OpenSSL does no path discovery.  Whatever certificates the
> > server sends, there is a linearly ordered subset[1] of these that
> > achieves the same validation result as the original heap of certs
> > for all OpenSSL-based clients.  So sending something other than a
> > linearly ordered list has no value.
> >
> > With OpenSSL 1.0.2 recently tweaked to do trust-store look-asides
> > for nodes in the middle of the provided linear list, as also noted
> > by Martin cross-signing with SHA256 or RSA 2048, ... works just
> > fine.
> 
> So the actual requirement is for a linearization of the DAG of certs,
> and this will produce the same results as considering all chains in
> the DAG? Or am I misunderstanding you?

OpenSSL only constructs one candidate path through the supplied
heap (with lookaside into a trust store at each link).  Therefore,
with respect to OpenSSL clients, supplying anything that is not
the lexically first chain is a waste of bandwidth.

If that lexically first linear chain does not work (possibly
truncated if an intermediate element is signed by a local trust
anchor), validation fails.

-- 
	Viktor.