RE: Enterprise-only or more...

[Russ Housley <housley@xxxxxxxxxxxx>]

Clearly, a trust anchor contains a public key that is used to 
validate digital signatures.  A trust anchor public key may be used 
in two different ways to support digital signature validation.  In 
the first approach, the trust anchor public key is used directly to 
validate the digital signature.  In the second approach, the trust 
anchor public key is used to validate a certification path.  I'm 
thinking about an X.509 certification path, but this model seems to 
work with other certification approaches as well.  When used with a 
certification path, the subject public key in the final certificate 
in the certification path is used to validate the digital 
signature.  Of course, such a certified public key can be used for 
things other than digital signature, including key transport and key 
agreement.  In X.509, the choices are constrained by the key usage 
certificate extension.

All trust anchors used in the X.509 context consist of the following 
components:

   - a public key signature algorithm identifier and associated 
public key, which
     may optionally include parameters;
   - a distinguished name for use in certification path validation 
and construction;
   - a public key identifier to aid path construction and for use in 
signatures
     that are to be validated directly with the trust anchor public key;
   - a list of applications (perhaps admitting all applications) 
with which the trust
     anchor can be used; and
   - optional X.509 certification path validation input values, some 
of which also
     serve as constraints on the use of the public key when used directly to
     validate digital signatures.

A similar set of components needs to be specified for any other 
contexts that we want to support (PGP, DNSSEC, etc.).

One might also want a human readable trust anchor title to help with 
display of the trust anchor store to users.

Depending on the approach taken in the trust anchor management 
protocol, a trust anchor might also include a sequence number for 
replay detection.

Russ