At 5:13 PM -0700 3/9/99, Adam Back wrote:
Jon said just now:
| CAs need something that they call in the X.509 world "basic
| constraints." These are ways that the CA can describe its
| certification. Lutz, for example, needs these for his CA business
| (and he was the main advocate of them). The most important one of
| those flags for a CA is the certification flag. This is how that CA
| states that the certification is a "leaf certificate" and not a
| sub-CA that can further certify people.
I understand Jon to be saying that if key A certifies another key B
with the CA flag enabled, this indicates that A is delegating ability
to certify *on A's behalf*.
This sounds useful. If I want to do something fancy with my keys,
such as:
- delegate trust from a securely stored key to other keys
which are used on a day to day basis
...
etc. I can use the CA flag to designate by sub-signature keys.
So if we examine Bob's key and it has a signature from Alice's key A2
and Alice's key A2 has a CA signature from Alice's key A1, that means
we can categorise the three identities: A2 and A1 are the same person.
B is someone else who A chose to certify the identity of.
This is useful in that if we trust A1, A1 is telling us to trust A2 to
the same level.
Of course, the level of trust is unlikely to be the same. A daily use key
is more likely to be compromised than a securely stored key. People may
place more trust in my 1024 bit DSA key than in my 768 bit RSA key, which
are cross signed. (Or they my put more trust in RSA than in DSA.)
-------------------------------------------------------------------------
Bill Frantz | Macintosh: Didn't do every-| Periwinkle -- Consulting
(408)356-8506 | thing right, but did know | 16345 Englewood Ave.
frantz(_at_)netcom(_dot_)com | the century would end. | Los Gatos, CA
95032, USA