Re: [TLS] rfc4366-bis-03 Discuss #2: hash alg. agility for TrustedCA?

[Simon Josefsson <simon at josefsson.org>]

Alfred "=?hp-roman8?B?SM5uZXM=?=" <ah at tr-sys.de> writes:

> (B)  Non-uniqueness of x509_name in Trusted CA Keys TLS extension
>
> The 3rd-to-last paragraph of Section 6 in the -03 version
> of the rfc4366-bis draft states:
>
> !  Note also that it is possible that a key hash or a Distinguished Name
> !  alone may not uniquely identify a certificate issuer (for example, if
> !  a particular CA has multiple key pairs). However, here we assume this
> !  is the case following the use of Distinguished Names to identify
> !  certificate issuers in TLS.
>
> It seems rather unlikely that this non-uniqueness happens for
> a key hash.

Can't you have multiple CA certificates for the same key?

/Simon
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls