Subject: RE: 3280bis: indirectCRL boolean in IDP (3/3)

From: "Manger, James H" <[email-masked]>
Date: Mon, 15 Nov 2004 14:44:42 +1100

The indirectCRL field should not be redefined.
CRL issuers do issue certificates if they are also CAs (as they often
are).
The indirectCRL field does not only indicate a "type b) indirect CRL" --
it must also be set to true for a "type a) indirect CRL".

Proposed action: don't accept Denis's proposed correction or proposed
note.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Denis Pinkas
Sent: Sunday, 14 November 2004 1:00 AM
To: [email-masked]
Cc: pkix
Subject: 3280bis: indirectCRL boolean in IDP (3/3)

3280bis: indirectCRL boolean in IDP (3/3)

This is a change and an addition proposal related to indirect CRLs.

From section 5.2.5 Issuing Distribution Point, "the CRL issuer MUST
assert the indirectCRL boolean, if the scope of the CRL includes
certificates issued by authorities other than the CRL issuer".

This sentence is incorrect since CRL issuers do not issue certificates.

Proposed correction: 

"The CRL issuer MUST assert the indirectCRL boolean, if the scope of the
CRL includes certificate identifiers from multiple authorities"
 
This boolean indicates a type b) indirect CRL but is named indirectCRL
boolean which is confusing with type a) indirect CRLs.

A note should be mentioned to clarify the ambiguity of the naming.

Proposed note: 

"The name of the boolean "indirectCRL" designates an indirect CRL that
includes certificate identifiers from multiple authorities, and not an
indirect CRL that includes certificate identifiers from a single CA.
An alternative name for that boolean would be: multipleCAs."

Denis

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 17 Nov 2004 14:30:06 +0100

James,

When the term CRL Issuer is used, it means an entity issuing CRLs, not
certificates.

If an entity issues public key certificates, then it is called a CA.

The question is the meaning of the indirectCRL boolean in IDP.

If we take a look at X.509, it is defined in the following way:

"If
indirectCRL is
true, then the CRL may contain revocation
notifications from authorities

other than the issuer of the CRL. "

Note the sentence, even incorrect at the end (and thus duplicating
an incorrect sentence from X.509)

is using the plural, i.e. "from
authorities" which means it is an
indirect CRL of type b).

Denis

-----Original Message-----

Proposed correction:

Proposed note:

Denis

---

From: "David A. Cooper" <[email-masked]>
Date: Wed, 17 Nov 2004 16:41:05 -0500

Denis Pinkas wrote:

James,

This is not true.  Paragraph 3 of section 5 in RFC 3280 begins: "CRL
issuers issue CRLs.  In general, the CRL issuer is the CA."

A CRL issuer is an entity that issues CRLs.  A CRL issuer may or may
not be a CA (i.e., an entity that issues certificates).  An entity that
issues indirect CRLs may or may not be a CA.  If it is a CA, then it
may issue a single CRL that covers its own certificates in addition to
the certificates of other CAs.

The
question is the meaning of the indirectCRL boolean in IDP.

"If
indirectCRL is

Note the sentence, even incorrect at the end (and thus
duplicating
an incorrect sentence from X.509)

You are misreading this sentence.  This does not mean that the
indirectCRL flag is only set to true if the CRL may contain revocation
notifications from more than one authority other than the issuer of the
CRL.  As long as the scope of the CRL includes certificates issued by
an entity other than the issuer of the CRL then the indirectCRL flag
must be set to true.

If some people are misinterpreting the current text to mean that the
flag should only be set if the CRL covers more than one CA other than
the CRL issuer then we can work on rewording the text.  But, we can not
change the meaning of the indirectCRL flag.

Dave

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 18 Nov 2004 15:09:20 +0100

David,

Denis
Pinkas wrote:

James,

which means: " In general, the CA is also the CRL issuer".

A CRL
issuer is an entity that issues CRLs.

Correct.

A CRL
issuer may or may
not be a CA (i.e., an entity that issues certificates).

Not exactly. An entity which issues CRLs may or may not also issue
certificates.

An entity
that
issues indirect CRLs may or may not be a CA.

I have a problem here. If you look at James proposal, he is proposing:

Indirect CRL Issuer: an optional system to which a CA delegates
the publication of certificate revocation lists;

If there is a delegation, this means that it does not issue CRLs
for itself.

If it is a
CA, then it

Same problem as above.

The

"If
indirectCRL is

We cannot understand each other since you are still using the words
"certificates issued by an entity other than the issuer of the CRL".

If we address the prtoblem from the relying party point of view, maybe
we will be able to have a common level of understanding.

If some
people are misinterpreting the current text to mean that the
flag should only be set if the CRL covers more than one CA other than
the CRL issuer then we can work on rewording the text.  But, we can not
change the meaning of the indirectCRL flag.

The goal is not to change the meaning, whatever the meaning is, but to
clarify the meaning so that we may all understand the same thing.

Then we will have to undertstand (and agree) what kind of processing a
RP can do with that flag. I can provide the beginning of the story:

"A RP got a CRL that is supposed to be about a given certificate for
which a path has been constructed.

The RP can check if the two following conditions are true:

1) the name of the issuer of the CRL is the same as the name of the CA,

2) the CRL is signed using the same key as the key of the CA.

If it is the case then this CRL is issued by the CA, acting as a CRL
Issuer."

Now what kind of test should be done with the indirectCRL boolean in
the IDP ?

Can that boolean be set to TRUE in any case ?

Denis

Dave

---

From: "David A. Cooper" <[email-masked]>
Date: Thu, 18 Nov 2004 15:43:20 -0500

Denis,

This is the last time that I am going to comment on this, either here
or on the X.500 list.

"CA" and "CRL issuer" define types of entities, not roles.  An
entity that issues public key certificates is a CA.  An entity
that issues CRLs is a CRL issuer.  Thus, a CA may issue CRLs
and a CRL issuer may issue certificates.

The issuer of an indirect CRL may also certificates.  If it does
issue certificates, then it may issue a single CRL that covers its own
certificates in addition to the certificates of other CA.  This is why
RFC 3280 states: "If [the certificateIssuer] extension is not present
on the first entry in an indirect CRL, the certificate issuer defaults
to the CRL issuer."  If a CA issues a CRL that covers both its own
certificates and the certificates of other CAs, and the first entry in
the CRL corresponds to a certificate issued by the issuer of the CRL,
then the certificateIssuer extension does not need to be included in
that entry.

The indirectCRL flag in the issuingDistributionPoint extension is
set whenever the CRL covers certificates signed by an entity other than
the issuer of the CRL.  That is, if the CRL covers any certificate that
has an issuer name different from the issuer name
in the CRL, then the indirectCRL flag is set to TRUE, otherwise it is
not.

Denis Pinkas wrote:

David,

Denis
Pinkas wrote:

James,

A CRL

Correct.

A CRL
issuer may or may

An entity
that

If there is a delegation, this means that it does not issue
CRLs
for itself.

If it is
a
CA, then it

Same problem as above.

The

"If
indirectCRL is

If some

Denis

Dave

---

From: Tom Gindin <[email-masked]>
Date: Thu, 18 Nov 2004 19:44:02 -0500

Denis:

      The indirectCRL boolean is set in any CRL which governs certificates
whose issuers have DN's different from the DN of the CRL's signer.  This is
independent of whether it is legal for the same CRL to govern certificates
whose issuers have the same DN as that of the CRL's signer.  I believe
these formulations are observable by RP's, and the first one is just a
restatement of RFC 3280 5.2.5.  However, the indirectCRL boolean has no
function in the verification of a certificate which doesn't contain the
cRLIssuer field in a CRL Distribution Points extension unless you ban CRL's
with both direct and indirect entries.  It does have a function in the
verification of a certificate which does contain cRLIssuer.
      BTW, I don't know how much use this field is to implementors as a
boolean and I think it might have been more useful as a SET of issuer
names.  However, we can hardly change its definition in a profile of X.509.

            Tom Gindin
P.S. -      The opinions in this message are mine, and not necessarily
those of my employer.

                      Denis Pinkas                                                         
                      <Denis.Pinkas@bul        To:       "David A. Cooper"                 
                      l.net>                    <[email-masked]>                    
                      Sent by:                 cc:       pkix <[email-masked]>          
                      owner-ietf-pkix@m        Subject:  Re: 3280bis: indirectCRL boolean  
                      ail.imc.org               in IDP (3/3)                               

                      11/18/2004 09:09                                                     
                      AM                                                                   

David,
       Denis Pinkas wrote:
            James,

                  The indirectCRL field should not be redefined.
                  CRL issuers do issue certificates if they are also CAs
                  (as they often
                  are).
            When the term CRL Issuer is used, it means an entity issuing
            CRLs, not certificates.
            If an entity issues public key certificates, then it is called
            a CA.
      This is not true.  Paragraph 3 of section 5 in RFC 3280 begins: "CRL
      issuers issue CRLs.  In general, the CRL issuer is the CA."
which means: " In general, the CA is also the CRL issuer".
      A CRL issuer is an entity that issues CRLs.
Correct.
      A CRL issuer may or may not be a CA (i.e., an entity that issues
      certificates).
Not exactly. An entity which issues CRLs may or may not also issue
certificates.
      An entity that issues indirect CRLs may or may not be a CA.
I have a problem here. If you look at James proposal, he is proposing:
Indirect CRL Issuer: an optional system to which a CA delegates the
publication of certificate revocation lists;
If there is a delegation, this means that it does not issue CRLs for
itself.
      If it is a CA, then it may issue a single CRL that covers its own
      certificates in addition to the certificates of other CAs.
Same problem as above.

            "If indirectCRL is true, then the CRL may contain revocation
            notifications from authorities
            other than the issuer of the CRL. "

            Note the sentence, even incorrect at the end (and thus
            duplicating an incorrect sentence from X.509)
             is using the plural, i.e. "from authorities" which means it is
            an indirect CRL of type b).
      You are misreading this sentence.  This does not mean that the
      indirectCRL flag is only set to true if the CRL may contain
      revocation notifications from more than one authority other than the
      issuer of the CRL.  As long as the scope of the CRL includes
      certificates issued by an entity other than the issuer of the CRL
      then the indirectCRL flag must be set to true.
We cannot understand each other since you are still using the words
"certificates issued by an entity other than the issuer of the CRL".
If we address the prtoblem from the relying party point of view, maybe we
will be able to have a common level of understanding.
      If some people are misinterpreting the current text to mean that the
      flag should only be set if the CRL covers more than one CA other than
      the CRL issuer then we can work on rewording the text.  But, we can
      not change the meaning of the indirectCRL flag.
The goal is not to change the meaning, whatever the meaning is, but to
clarify the meaning so that we may all understand the same thing.
Then we will have to undertstand (and agree) what kind of processing a RP
can do with that flag. I can provide the beginning of the story:

"A RP got a CRL that is supposed to be about a given certificate for which
a path has been constructed.
The RP can check if the two following conditions are true:

Now what kind of test should be done with the indirectCRL boolean in the
IDP ?
Can that boolean be set to TRUE in any case ?

Denis
      Dave

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 19 Nov 2004 10:14:54 +0100

Dave,

Denis,

Maybe not, since as you will see, we are close to an agreement.

The issuer of an indirect CRL may also certificates.  If it
does

The indirectCRL flag in the issuingDistributionPoint extension
is
set whenever the CRL covers certificates signed by an entity other than
the issuer of the CRL.  That is, if the CRL covers any certificate that
has an issuer name different from the issuer name
in the CRL, then the indirectCRL flag is set to TRUE.

From 1, since an "entity
that issues CRLs is a CRL issuer", an entity that issues
certificates cannot be called a CRL issuer.

This is exactly why we have problems with the current text. From 2, the
sentence "the issuer of an indirect CRL may also certificates" is in
contradiction with 1: an entity that issues public key certificates is
a CA, not a CRL issuer. This only a problem of naming but this problem
needs to be sort out. See below.

I would reformulate slightly your sentence: "If an authority issues
certificates, then the same authority  may issue a single CRL that
covers its own
certificates in addition to the certificates of other CAs." This is why
RFC 3280 should state: "If [the certificateIssuer] extension is not
present
on the first entry in an indirect CRL, the certificate issuer defaults
to the name contained in the issuer field of the CRL."  If you can
agree with this modification, then this will solve my concern.

About 3, RFC 3280 states: "The CRL
issuer MUST assert the indirectCRL boolean,
if the scope of the CRL includes certificates issued by authorities
other than
the CRL issuer."  You said: "The
indirectCRL flag in the issuingDistributionPoint extension is
set whenever the CRL covers certificates signed by an entity other than
the issuer of the CRL." I fully agree with your text which should come
into replacement of the RFC 3280 quoted sentence.

I also agree with your additional explantion, which is: "if the CRL
covers any certificate that
has an issuer name different from the issuer name
in the CRL, then the indirectCRL flag is set to TRUE, otherwise it is
not." This additional sentence could be useful.

This demonstrates that through a dialogue, it is possible to come to
agreements.

Denis

Denis
Pinkas wrote:

David,

Denis
Pinkas wrote:

James,

A CRL

Correct.

A CRL
issuer may or may

An
entity
that

If it
is
a
CA, then it

Same problem as above.

The

"If
indirectCRL is

If some

Denis

Dave