Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What do people mean by saying that X.509 certificates work in "top-down manner"? Do they say that because CAs can do cross certifications?

share|improve this question
add comment

migrated from crypto.stackexchange.com Jan 10 at 16:51

This question came from our site for software developers, mathematicians and others interested in cryptography.

1 Answer

up vote 2 down vote accepted

"Top-down" means that certificate validation proceeds from the root CA down to the end-entity certificate (i.e. the certificate you want to validate). This relates to the idea that an X.509 PKI is meant to be hierarchical: at the "top" there is one or a few root CA, which are trusted a priori, and then trust trickles down to the intermediate CA whose certificates have been issued (signed) by a root CA, then to other intermediate CA issued by the previous intermediate CA, and so on, until trust reaches the certificate for an email user or SSL server.

Notions of "up" and "down" are completely arbitrary, of course, but it is traditional to consider that the source of authority and trust is at "the top".

Interestingly, the root of a biological tree is at the bottom; however, in computer science, trees are customarily represented with the root on top, as in this picture (taken from Wikipedia):

a tree picture

By contrast, the PKI structure for which OpenPGP was designed, i.e. the Web of trust, is not "top-down" because it is highly decentralized, so there is no "top" entity.


Cross-certification are in fact non-tree-like features; the more cross-certifications you do, the less top-down the PKI becomes. One could say that the Web of trust is a hierarchical PKI with so many cross-certification that the initial, hierarchical structure has become redundant and was bodily removed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.