[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: Enterprise-only or more...

Clearly, a trust anchor contains a public key that is used to validate digital signatures. A trust anchor public key may be used in two different ways to support digital signature validation. In the first approach, the trust anchor public key is used directly to validate the digital signature. In the second approach, the trust anchor public key is used to validate a certification path. I'm thinking about an X.509 certification path, but this model seems to work with other certification approaches as well. When used with a certification path, the subject public key in the final certificate in the certification path is used to validate the digital signature. Of course, such a certified public key can be used for things other than digital signature, including key transport and key agreement. In X.509, the choices are constrained by the key usage certificate extension.

All trust anchors used in the X.509 context consist of the following components:

- a public key signature algorithm identifier and associated public key, which
     may optionally include parameters;
- a distinguished name for use in certification path validation and construction; - a public key identifier to aid path construction and for use in signatures
     that are to be validated directly with the trust anchor public key;
- a list of applications (perhaps admitting all applications) with which the trust
     anchor can be used; and
- optional X.509 certification path validation input values, some of which also
     serve as constraints on the use of the public key when used directly to
     validate digital signatures.

A similar set of components needs to be specified for any other contexts that we want to support (PGP, DNSSEC, etc.).

One might also want a human readable trust anchor title to help with display of the trust anchor store to users.

Depending on the approach taken in the trust anchor management protocol, a trust anchor might also include a sequence number for replay detection.