Naming Structure:



                        A                   B
                       / \                 /|\
                      C   D               M E F
                     / \  |\             /     \
                    G   H I J           K       L


Cert List  (if you are using a model that doesn't allow you to have these
certs, contact me ASAP so we can work something out ahead of time for
your demo)


Issuer Subject  Policy  Expiration/Duration = 	Long for all certs in this
		Level				scenario

A	C	1
A	C	2
C	A	2
C	G	2
C	H	1
G	C	2
H	C	1
A	D	2
D	A	1
D	I	3
D	I	2
I	D	1  <added late
D	J	2
J	D	2
B	M	3
M	B	3
B	E	2
E	B	2
B	F	1
F    None  (F doesn't issue Certs, but does have B's public
            key, and considers B a level 2 trust anchor)
B	L	1
L	F	1
M	K	3
K	M	3



Possible Questions (in order), and some reasonable answers:


Q:	Can D verify G's public key at a policy level of 2 ?
A:	Previous answer is incorrect
	Perhaps, but the best I can find is a level one:
	D<<A,1>>, A<<C,2>>, C<<G,2>>

Q:	Can G verify D's public key at a policy level of 2?
A:	typo again, these two were switched:
	Yes, G<<C,2>>,C<<A,2>>,A<<D,2>>

Q:	Can K verify J's public key at (policy) level 2?
A:	No, no path found.  (so there may be a path, but I can't find it).

Q:	Suppose M and D enter form a trust relationship.  Through offline
	methods, they agree to trust each other at (policy) level 3.  
	Generate these cross-certificates and add them to your model.

(Two certs would be added to the above list:

Issuer Subject  Policy
		Level

M	D	3
D	M	3

You do not need to show me this list, but the ability to show it would probably 
be a good de-bugging tool).

Q:      Now, can K verify J's public key at (policy) level 2?
A:      Yes, the path is:  K<<M,3>>, M<<D,3>>,D<<J,2>>

Q:	Can E verify J's public key at (policy) level 2?
A:	I can't find a path.

Q:	The path is:  E<<B,2>>, B<<M,3>>, M<<D,3>>, D<<J,2>>.  Is it
	verifiable.
A:	Yes, that is a valid path.

Q: 	Why didn't you find the path?
A: 	I used the algorithm discussed in class, and my search terminated
	before I got to node M (since it is not a direct ancestor of either
	E or J.

Q:	Revoke the (policy) level 2 cert A<<C,2>>.  Now see if you can find
	a level 2 path that D can use to verify G's public key.
A:	No path found.

Q:	Earlier you said that:  D<<A,2>>, A<<C,2>>, C<<G,2>> was a level
	2 path.  Can you verify this path.
A:	No, the cert A<<C,2>> has been revoked.

Q:	Please allow me to/show me how to make a new copy of the cert A<<D,2>>.
	Change the subject name (of the copy) to C.  Now see if you can verify
	the above path (D<<A,2>>, A<<C,2>>, C<<G,2>>, where A<<C,2>> is now
	a forgery).
A:	Nope, signature doesn't match for A<<C,2>>.

Q:	Let's try again, make a copy of A<<C,1>>, and edit it so that the 
	policy level is "2".  Try to pass it off in the above chain.
A:	Nope, sig doesn't match

Q:	Now delete (revoke) the cross certs between D and M, add a new root 
	node R, and issue the following certs:

	Issuer Subject  Policy
			Level

	A	R	2
	R	A	2
	B	R	3
	R	B	3

	(This makes your name space look like this, maybe:



                              R
                             / \
                            /   \
                           /     \ 
                          /       \
                         /         \
                        A           B
                       / \         /|\
                      C   D       M E F
                     / \  |\     /     \
                    G   H I J   K       L


	or maybe like this:




                        A----R------B
                       / \         /|\
                      C   D       M E F
                     / \  |\     /     \
                    G   H I J   K       L



I don't really care, but you either need to make your naming scheme flexible
enough to add the root as in the top example (maybe some extra fields, or 
starting the trees I give you down a couple of levels), or make your search 
algorithm flexible enough (indirection, some kind of look up table at top
nodes, etc) to find these links.  In other words, I want R treated like an
ancestor of A and B if your search algorithm is like the one we discussed in
class.  I'll ask some questions like the above to see if those links are found
properly.

Q:  	etc, etc, etc