Interoperability%20Testing%20for%20RFCs%203279%20and%203280

1
Interoperability Testing for RFCs 3279 and 3280

• Tim Polk
• tim.polk_at_nist.gov

2
Scope

• Verify that two implementations can correctly
  generate each of the features in the certificates
  and CRLs
• Verify that two implementations correctly process
  path validation features
• Note application handling of features
  (e.g., extended key usage or otherName) is out of
  scope

3
Generation Testing

• Generation testing for certificates and CRLs is
  nearly complete
• 90 of features have been confirmed
• Need volunteers for certain features
• Open issues
• DSA parameter inheritance, Diffie-Hellman, EC
  cryptography, and Delta CRLs
• If we cant find examples, we will have to remove
  them as we progress!!!

4
Path Validation Tests

• Path validation tests are published
• 221 tests available in beta
• Three known implementations currently undergoing
  testing
• Expecting Delta CRLs to present issues
• Tests available at
• http//csrc.nist.gov/pki/testing/x509paths.html

5
Credits Contacts

• Jim Schaad developed the initial matrix
• Chris Brown (NIST) managing generation testing
• chris.j.brown_at_nist.gov
• NIST DigitalNet developed path validation test
  suite
• NIST contact is david.cooper_at_nist.gov
• Email list for test suite pkits_at_nist.gov
• Subscription process at http//csrc.nist.gov/pki/t
  esting/x509paths.html