Subject: 3280bis: CRL processing for indirect CRLs (2/3)

From: Denis Pinkas <[email-masked]>
Date: Sat, 13 Nov 2004 14:57:58 +0100

3280bis: CRL processing for indirect CRLs (2/3)

This is an addition proposal related to indirect CRLs.

The following text is proposed:

"X. CRL processing for indirect CRLs

X.1. Basic processing

For an indirect CRL, the relying party :

 - SHOULD fetch a CRL looking at the content of distributionPoint
   field the from the CRL DP extension of the certificate for which
   a revocation status is looked for, 

 - SHALL find a CRL Isssuer certificate that contains the DN of the
   CRL Issuer as indicated in the cRLIssuer field from the CRL DP
   extension,

 - SHALL verify that this CRL Isssuer certificate is signed by the CA
   which has issued the certificate for which a revocation status is
   looked for.

 - SHALL verify that this CRL Isssuer certificate is not revoked
   (see section X.2)
 
     If the indirectCRL boolean from the Issuing Distribution

     Point extension of the CRL is missing or set to FALSE, SHALL find
     out a CRL entry containing the certificate serial number of the
     certificate for which a revocation status is looked for. If no
     entry is found, then the certificate is valid. If an entry is
     found, then the certificate is revoked. 

     If the indirectCRL boolean from the Issuing Distribution Point
     extension of the CRL is set to TRUE, SHALL find out all CRL
     entries containing the certificate serial number of the
     certificate for which a revocation status is looked for.

       If no entry is found, the certificate is valid.

       If an entry is found, then for each found entry the following
       processing SHALL be done: 

          SHALL compare the DN contained in the issuer field from
          the certificate for which a revocation status is looked for,
          with the DN contained in every the certificateIssuer entry
          extension.  

             If there is no match and if there is no certificateIssuer
             entry extension present before this CRL entry, then the
             certificate is revoked.
 
             If there is a match and if the certificateIssuer entry
             extension present before this CRL entry matches the name
             of the DN contained in the issuer field from the
             certificate for which a revocation status is looked for,
             then the certificate is revoked.
 
             Otherwise, the certificate is valid. 

X.2 Verification that the CRL Isssuer certificate is not revoked
 
(text to be provided) ".

Denis