PKIX and verification depth.

[Cantor, Scott]

On 7/2/14, 10:31 AM, "Ian Young" <ian at iay.org.uk> wrote:
>
>On 2 Jul 2014, at 15:23, Rod Widdowson <rdw at steadingsoftware.com> wrote:
>
>> Yup, but what I don't know enough to know is whether that is a sensible
>> enough default in non-IdP situations to break the current paradigm of
>> requiring an (application defined) value.
>
>If "1" would mean that the metadata would have to be directly signed by
>the trust root, then I'd reckon that to be a fine default.

The depth of 1 (or 0 if I'm off by one) means it's one layer removed. The
trust root(s) sign the certificates that sign the metadata.

It may be that 0 degenerates into the same as what you're talking about,
which you'd normally do with the explicit key engine.

-- Scott