Subject: CRLs

From: [email-masked]
Date: Mon, 26 Mar 2001 09:41:49 +0100

Hi,
	I'm trying to split CA functionality. I want to have one private key
to sign certificates (CA key), and the second one to sign CRLs.
	First is it possible to do it? Because in the standard I've found:
"The CRL is signed using the CA's private key." (is it the same CA, which
sign this certificate? In other words, CA can only revoke certificates it
signed, Am I right?)
	
	I've read draft "Internet X.509 Public Key Infrastructure:
Certificate and CRL Profile" and I didn't find response. Could someone
explain me what for is CRL entry extension Certificate Issuer, I guess
should indicate certificate signer, but it should be the same authority
which signed CRL. In my opinion it's not clear enough.

Reagrds,

Pawel Krupinski

---

From: Dean Povey <[email-masked]>
Date: Tue, 27 Mar 2001 10:24:47 +1000

>sign this certificate? In other words, CA can only revoke certificates it

Hi Pawel,

You can use the cRLDistributionPoint extension to indicate a CRL issuer 
other than the CA that issued the Certificate.  See section 4.2.1.14 of
RFC2459, or of the updated Cert and CRL profile at:

http://www.ietf.org/internet-drafts/draft-ietf-pkix-new-part1-05.txt

-- 
Dean Povey,         | e-m: [email-masked] | JCSI:  Java Crypto Toolkit 
Research Scientist  | ph:  +61 7 3864 5120   | uPKI:  C PKI toolkit for embedded
Security Unit, DSTC | fax: +61 7 3864 1282   |        systems
Brisbane, Australia | www: security.dstc.com | Oscar: C++ PKI toolkit