Skip to content

Commit 86af2bd

Browse files
committed
Clarify all the ways ranges are used
1 parent 286f174 commit 86af2bd

1 file changed

Lines changed: 6 additions & 1 deletion

File tree

draft-davidben-tls-merkle-tree-certs.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1408,7 +1408,12 @@ The following procedure can be used to perform this check. It succeeds if `r` co
14081408
* The certification path's trust anchor ID appears in the relying party's `trust_anchors` extension, or
14091409
* One of the certification path's additional trust anchor ranges contains some ID in the relying party's `trust_anchors` extension
14101410

1411-
In applications that use additional trust anchor ranges, relying parties MAY send a single trust anchor ID to represent all certificates whose trust anchor ranges contain that trust anchor ID.
1411+
Trust anchor ranges do not impact an authenticating party's list of available trust anchors in EncryptedExtensions (see {{Section 4.3 of !I-D.ietf-tls-trust-anchor-ids}}) or the HTTPS/SVCB record (see {{Section 5 of !I-D.ietf-tls-trust-anchor-ids}}). Those continue to reference the single trust anchor ID that corresponds to each certificate.
1412+
1413+
In applications that use additional trust anchor ranges, relying parties MAY send a single trust anchor ID to represent all certificates whose trust anchor ranges contain that trust anchor ID. This includes:
1414+
1415+
* Trust anchors that are sent in response to an EncryptedExtensions or HTTPS/SVCB message from the authenticating party
1416+
* Trust anchors that are sent in `trust_anchors`, independently of the authenticating party
14121417

14131418
## Using Trust Anchor IDs
14141419

0 commit comments

Comments
 (0)