Subject: Re: [lamps] [Technical Errata Reported] RFC5280 (5938)

From: "chenyt-sjtu" <[email-masked]>
Date: Wed, 18 Dec 2019 09:50:09 +0800

Hi, Rich,

Thank you for explaining the word "binding". The validity and the subjectAltName
can be trusted if the certificate can pass "path validation", right? 

Binding is not a strict word. I found that public key certificates are defined as data 
structures that "bind" public key values to subjects (Sec. 3.1). Should the "binding 
between a subject and a subject key", rather than the "binding between a subject 
distinguished name or a subject alternative name and subject public key" (Sec. 6.1), 
get verified in a path validation?

Yuting

-----邮件原件-----
发件人: Salz, Rich <[email-masked]> 
发送时间: 2019年12月17日 22:40
收件人: chenyt-sjtu <[email-masked]>; 'Stefan Santesson' <[email-masked]>; 'Benjamin Kaduk' <[email-masked]>
抄送: 'Roman D. Danyliw' <[email-masked]>; 'David Cooper' <[email-masked]>; [email-masked]; 'Russ Housley' <[email-masked]>; 'LAMPS WG' <[email-masked]>; 'IETF PKIX' <[email-masked]>; 'RFC Editor' <[email-masked]>; 'Stephen Farrell' <[email-masked]>
主题: Re: [lamps] [Technical Errata Reported] RFC5280 (5938)

The CA, when it signs a certificate, is saying that all of the information in the certificate is correct.

By convention, we talk about "binding" the key to the SubjectDN, but all of the information -- notAfter, subjectAltName, etc -- are valid, if you trust the CA (or have a path to a chain up to a CA that you do trust). We don't talk about "binding" the key to its validity period.

---

From: Stefan Santesson <[email-masked]>
Date: Wed, 18 Dec 2019 09:33:41 +0100

Yuting,

It seems that you are still stuck in backwards thinking, and I'm not sure I can unstack you in a single sentence.

We are trying to tell you that you don't verify the binding of a name as part of certificate validation.
You perform certificate validation so you can trust the information in the certificate.

Stefan Santesson 

On 2019-12-18, 02:50, "chenyt-sjtu" <[email-masked]> wrote:

    Hi, Rich,

    
    Yuting

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 18 Dec 2019 16:29:09 +0000

EXACTLY!