Subject: RE: Open Issue in Part1: path length constraints

From: "David P. Kemp" <[email-masked]>
Date: Mon, 5 Mar 2001 16:06:22 -0500 (EST)

Steve,

I think of a "CA" as some people in a room with a Safekeeper.
If a CA wants to run its certificate signing functions on a machine
with no network connections, and it's CRL signing functions on a
network-connected machine, wouldn't that CA issue a certificate
to its CRL-signing key signed by its certificate-signing key?

If that certificate has cA=false, and keyCertSign=0 and cRLSign=1,
isn't the subject of the certificate "a conforming CA"?

When X.509 says "keyCertSign: for verifying a CA's signature on
certificates", doesn't "a CA" refer to the people with the signing
machine, not a public key in a certificate with cA=true?  

Regards,
Dave

From: Stephen Kent <[email-masked]>
> 
> The text avoids referring to a CA as the indirect CRL issuer at first,
> but then refers to conforming CAs in the last paragraph. If something
> other than a CA issues an indirect CRL, or any kind of CRL, then the
> wording used throughout 2459 seems to not apply to such an entity,
> because we almost always seem to come back to phrases like "if used by a
> fonforming CA ..." The best rationale I've usually heard for indirect
> CRLs has been for one CA to issue a CRL for another, e.g., if the latter
> CA looses the ability to issue CRLs to to destruction of its private
> key.
> 
> Steve

---

From: David Simonetti <[email-masked]>
Date: Mon, 05 Mar 2001 16:30:10 -0500

Dave,

> isn't the subject of the certificate "a conforming CA"?

No, it is an end entity.
--
David Simonetti
Securify (www.securify.com), 410-356-2260

---

From: Stephen Kent <[email-masked]>
Date: Tue, 6 Mar 2001 14:42:30 -0500

Dave,

>to its CRL-signing key signed by its certificate-signing key?

I agree that there is ambiguity in what we mean when we refer to a CA 
in such circumstances, but algorithmically I have always assumed that 
only CAs issued CRLs and we can tell whether the entity is a CA by 
the basic constraints extension. I see there is considerable 
sentiment to allow for non-CA flagged entities to sign CRLs, but I'm 
not yet sure I understand why folks consider it important to not turn 
on the CA flag in certs for such entities. After all, since we have 
separate key usage bits for cert and CRL signing, we can construct a 
cert for an entity that signs CRLs and not grant that entity the 
ability to sign certs, if we so desire.

As for your example, I would have expected the CA to accomplish the 
same effect by having a second cert, with the same name, but with a 
different key and with the key usage bits set to indicate CRL signing 
but not cert signing. In that case, I would have expected the cert 
for this second instance of the CA to have the CA flag set to true.

>isn't the subject of the certificate "a conforming CA"?

Not by my understanding.

>machine, not a public key in a certificate with cA=true?

I have adopted a more restrictive interpretation, but I can be 
persuaded otherwise IF I get a good answer to the question I posed 
above.  Also, if we are to accommodate non-CA-flagged entities 
signing CRLs, we need to chnage the text in 2459bis in a lot of 
places and make this very clear up front.

Steve

---

From: David Simonetti <[email-masked]>
Date: Tue, 06 Mar 2001 17:09:05 -0500

Steve,

Stephen Kent wrote:

>  I see there is considerable

I don't think so.  From Section 4.2.1.10:

"If the cA bit is asserted, then the keyCertSign bit in the key usage extension
(see 4.2.1.3) MUST also be asserted."

---

From: Stephen Kent <[email-masked]>
Date: Wed, 7 Mar 2001 14:40:22 -0500

David,

>(see 4.2.1.3) MUST also be asserted."

Good point; I missed that one!

So, if we adhere to this constraint we can't have an entity labelled 
as a CA but restricted to issuing only CRLs.  So, we need to 
reconcile the various parts of the document to have a consistent, 
well-defined description of what folks can/should do to separate out 
CRL signing from cert signing.

Steve