Subject: RE: 3280bis: indirectCRL boolean in IDP (3/3)

From: "Manger, James H" <[email-masked]>
Date: Thu, 18 Nov 2004 14:07:26 +1100

I think Denis is saying the term "CRL issuer" is only used for
authorities that issue CRLs but not certificates.  A CA that issues CRLs
cannot be called a "CRL issuer".  I find this usage unnatural, awkward,
inconsistent with X.509 and partially inconsistent with RFC 3280.  To my
mind, if an authority issues CRLs it can be called a "CRL issuer" --
regardless of whether or not it also issues certificates.
 
RFC 3280 section 3 "Overview of Approach" supports Denis's
interpretation:
"CRL issuer: an optional system to which a CA delegates the publication
of certificate revocation lists;"

But section 5 "CRL and CRL Extension Profile" certainly doesn't:
"CRL issuers issue CRLs.  In general, the CRL issuer is the CA."
Lots of other text also doesn't support Denis's interpretation:
Section 4.1.2.6: "If the subject is a CRL issuer (e.g., the key usage
extension, as discussed in 4.2.1.3, is present and the value of cRLSign
is TRUE)...", which can be true for a CA.
Section 4.2.1.14: "If the certificate issuer is also the CRL issuer ..."
Also "If the certificate issuer is not the CRL issuer ..."
Also consider the nameRelativeToCRLIssuer field, which can be appended
to the CA name.
Section 5: "Whenever the CRL issuer is not the CA..."
Section 5.1.1.3: "CAs that are also CRL issuers MAY use..."
etc.
 
Proposal: In section 3 "Overview of Approach", rename the "CRL Issuer"
component to "Indirect CRL Issuer" (adding the word "Indirect" in three
places).
"...
Indirect CRL Issuer: an optional system to which a CA delegates the
publication of certificate revocation lists;
...
...might also chose to delegate the publication of CRLs to an Indirect
CRL issuer.
...
   +----------------------------+
   | Indirect CRL Issuer |
   +----------------------------+
..."
 
Other sentences in the body of the RFC mentioning CRL issuer can remain
unchanged.

RE: "may contain revocation notifications from authorities other than
the issuer of the CRL"
Replacing "authorities" with "one or more authorities" does not change
the meaning of this English sentence at all -- it covers "type a)" and
"type b)" indirect CRLs.

  _____  

From: Denis Pinkas [mailto:[email-masked]] 
Sent: Thursday, 18 November 2004 12:30 AM
To: Manger, James H
Cc: [email-masked]; pkix
Subject: Re: 3280bis: indirectCRL boolean in IDP (3/3)

James,

The indirectCRL field should not be redefined.

CRL issuers do issue certificates if they are also CAs (as they often

are).

When the term CRL Issuer is used, it means an entity issuing CRLs, not
certificates. 
If an entity issues public key certificates, then it is called a CA.

The question is the meaning of the indirectCRL boolean in IDP.

If we take a look at X.509, it is defined in the following way:

"If indirectCRL is true, then the CRL may contain revocation
notifications from authorities 
other than the issuer of the CRL. "

Note the sentence, even incorrect at the end (and thus duplicating an
incorrect sentence from X.509)
 is using the plural, i.e. "from authorities" which means it is an
indirect CRL of type b).

Denis

The indirectCRL field does not only indicate a "type b) indirect CRL" --

it must also be set to true for a "type a) indirect CRL".

Proposed action: don't accept Denis's proposed correction or proposed

note.

-----Original Message-----

From: [email-masked] [mailto:[email-masked]]

On Behalf Of Denis Pinkas

Sent: Sunday, 14 November 2004 1:00 AM

To: [email-masked]

Cc: pkix

Subject: 3280bis: indirectCRL boolean in IDP (3/3)

3280bis: indirectCRL boolean in IDP (3/3)

This is a change and an addition proposal related to indirect CRLs.

>From section 5.2.5 Issuing Distribution Point, "the CRL issuer MUST

assert the indirectCRL boolean, if the scope of the CRL includes

certificates issued by authorities other than the CRL issuer".

This sentence is incorrect since CRL issuers do not issue certificates.

Proposed correction: 

"The CRL issuer MUST assert the indirectCRL boolean, if the scope of the

CRL includes certificate identifiers from multiple authorities"

This boolean indicates a type b) indirect CRL but is named indirectCRL

boolean which is confusing with type a) indirect CRLs.

A note should be mentioned to clarify the ambiguity of the naming.

Proposed note: 

"The name of the boolean "indirectCRL" designates an indirect CRL that

includes certificate identifiers from multiple authorities, and not an

indirect CRL that includes certificate identifiers from a single CA.

An alternative name for that boolean would be: multipleCAs."

Denis

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 18 Nov 2004 15:06:46 +0100

James,

The fix to the text that you are proposing is interresting. However ...

I think Denis is saying the
term "CRL issuer" is only used for authorities that issue CRLs but not
certificates.

No. This is not exactly what I am saying. "CRL Issuer" is a role
endorsed by an authority in its capacity to issue CRLs.

In the same way, a "Certificate Issuer" is a role endorsed by an
authority in its capacity to issue public key certificates.

The same authority can have both roles, but only for the certificates
it issues.

A CA that issues CRLs cannot
be called a "CRL issuer".  I find this usage unnatural, awkward,
inconsistent with X.509 and partially inconsistent with RFC 3280.  To
my mind, if an authority issues CRLs
it can be called a "CRL issuer" -- regardless of whether or not it also issues certificates.

This last point is correct.

RFC 3280 section 3 "Overview
of Approach" supports Denis's interpretation:

"CRL
issuer: an optional system to which a CA delegates the publication of
certificate revocation lists;"

But section 5 "CRL and CRL
Extension Profile" certainly doesn't:

"CRL
issuers issue CRLs.  In general, the CRL issuer is the CA."

which means: " In general, the CA is also the CRL issuer" .

Lots of other text also
doesn't support Denis's interpretation:

Section
4.1.2.6: "If the subject is a
CRL issuer (e.g., the key usage extension, as discussed in 4.2.1.3, is
present and the value of cRLSign is TRUE)...", which can be true
for a CA.

which means: "If the same authority is at the same time a certificate
issuer and a CRL issuer ..."

which means:: "If the certificate issuer is not issuing directly the
CRLs.

Also consider the nameRelativeToCRLIssuer field, which can be
appended to the CA name.

which is correct.

etc.

which means: "Authorities which are both CAs and CRL issuers MAY use
..."

Proposal: In section 3
"Overview of Approach", rename the "CRL Issuer" component to "Indirect
CRL Issuer" (adding the word "Indirect" in three places).

"...

Indirect CRL Issuer: an optional system to which a CA delegates
the publication of certificate revocation lists;

...

...might also chose to delegate the
publication of CRLs to an Indirect CRL
issuer.

...

| Indirect CRL
Issuer |

..."

Other sentences in the body of the RFC
mentioning CRL issuer can remain unchanged.

"Indirect CRL issuer" would be clear but in many other places we would
also need to use that naming.

However we would then need to clarify whetehr the term "CRL issuer"
used without
any qualifier in front of it

would mean:

a) a CA which issues certificate revocation status information, only
for the certificates it issues, or

b) either case a) above or an indirect CRL issuer ?

I believe that your proposal is for a) otherwise we would have to
introduce a difference

between an "indirect CRL issuer" and a "direct CRL issuer"

Denis

RE: "may contain revocation notifications
from authorities other than the issuer of the CRL"

Replacing "authorities" with "one or more
authorities" does not change the meaning of this English sentence at
all -- it covers "type a)" and "type b)" indirect CRLs.

From: Denis
Pinkas [mailto:[email-masked]]

To: Manger, James H

James,

"If
indirectCRL is
true, then the CRL may contain revocation notifications from
authorities

Note the sentence, even incorrect at the end (and thus
duplicating an incorrect sentence from X.509)

is using the plural, i.e. "from
authorities" which means it is an
indirect CRL of type b).

Denis

-----Original Message-----

Proposed correction:

Proposed note:

Denis