Subject: [dane] Pseudocode in -18 for usage certificate usage 2 incorrect

From: Ondrej Mikle <[email-masked]>
Date: Wed, 21 Mar 2012 15:29:52 +0100

Hi,

current pseudocode for certificate usage 2 only tests match against
end-entity certificate C:

     // pass PKIX certification validation using TLSA record as the
     //    trust anchor
     if (R.certUsage == 2) {
       for each PKIX certification path H that has R as the
            trust anchor {
         if (C passes PKIX certification validation in H) and
                Match(R.matchingType, Select(R.selectorType, C),
                R.cert)) {
           Finish(ACCEPT)
         }
       }
     }

The Match() needs to check every certificate from chain, a new version
could be:

     // pass PKIX certification validation using TLSA record as the
     //    trust anchor
     if (R.certUsage == 2) {
       for each PKIX certification path H that has R as the
            trust anchor {
         if (C passes PKIX certification validation in H) {
           for each D in H {
             if (Match(R.matchingType, Select(R.selectorType, D),
                       R.cert)) {
               Finish(ACCEPT)
             }
           }
         }
       }
     }

Ondrej Mikle

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 21 Mar 2012 13:42:39 -0700

No, if the certificate is a trust anchor, the chain stops at that point.

Jim

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Ondrej Mikle
> Sent: Wednesday, March 21, 2012 7:30 AM
> To: [email-masked]
> Subject: [dane] Pseudocode in -18 for usage certificate usage 2 incorrect
> 
> Hi,
> 
> current pseudocode for certificate usage 2 only tests match against end-
> entity certificate C:
> 
could
> be:
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane