Subject: RE: Signer certificate discovery for CRLs

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 3 Nov 2004 10:25:42 -0500

Denis,

See responses in-line in [SC:]

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]] 
Sent: Wednesday, November 03, 2004 9:58 AM
To: Santosh Chokhani
Cc: 'pkix'; David A. Cooper
Subject: Re: Signer certificate discovery for CRLs

Santosh,

> Denis,
> 
> Just show us how SIA (wherever you want to put it) is more efficient 
> than AIA for CRL signer.

The question is not whether it is better or not.

Walking on certification paths can be done bottom-up (using AIA extensions) 
or top-down (using SIA extensions).

[SC: Before we get into path, the purpose of this AIA is simply to get the
end certificate which protocols such as CMS S/MIME provide]

It should be RECOMMENDED to place an SIA extension in every CA certificate, 
starting from every Trust Anchor (TA) when the TA is expressed using a 
self-signed certificate.

As I already said, information is missing in RFC 3280: we need to say more 
about the formats implied by accessMethod.

There are four possible cases :

  1 - it allows to retrieve one single file,
  2 - it allows to query for a single file in a repository,
  3 - it allows to query for one or more files in a repository,
  4 - it provides the address of a repository.

The current text should be clarified whether accessMethod is used in an AIA 
extension or in an SIA extension. Cases 3 and 4 apply to the SIA extension.

[SC: For both AIA and SIA, at least an HTTP pointer to a p7 file containing
one or more certificates and pointer to ldap attribute should be permitted.]

Denis

> -----Original Message-----
> From: Denis Pinkas [mailto:[email-masked]]
> Sent: Thursday, October 28, 2004 10:04 AM
> To: Santosh Chokhani
> Cc: 'pkix'
> Subject: Re: Signer certificate discovery for CRLs
> 
> 
> Santosh,
> 
> You wrote:
> 
> 
>>And, SIA for end certificate will add computational complexity.
> 
> 
> SIA, for this discussion, is not for end certificates, but for CA 
> certificates.
> 
> Denis
> 
> 
>

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 03 Nov 2004 15:57:54 +0100

Santosh,

> Denis,
> 
> Just show us how SIA (wherever you want to put it) is more efficient than
> AIA for CRL signer.

Denis

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 04 Nov 2004 18:33:58 +0100

Santosh,

See responses in-line in [DP:]

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]]
Sent: Wednesday, November 03, 2004 9:58 AM
To: Santosh Chokhani
Cc: 'pkix'; David A. Cooper
Subject: Re: Signer certificate discovery for CRLs

Santosh,

[DP: At this time I do not care for the details, but I only want to point 
out to David Cooper that text is needed on that topic].

Denis

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 4 Nov 2004 15:51:31 -0500

Denis,

As I said, we are well ahead of you if you look at my and Stefan's and the
Chinese gentleman's postings on the syntax of AIA.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Denis Pinkas
Sent: Thursday, November 04, 2004 12:34 PM
To: Santosh Chokhani
Cc: 'pkix'
Subject: Re: Signer certificate discovery for CRLs

Santosh,

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]]
Sent: Wednesday, November 03, 2004 9:58 AM
To: Santosh Chokhani
Cc: 'pkix'; David A. Cooper
Subject: Re: Signer certificate discovery for CRLs

Santosh,

 > Denis,
 >
 > Just show us how SIA (wherever you want to put it) is more efficient  >
than AIA for CRL signer.

Denis

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 05 Nov 2004 15:27:42 +0100

Santosh,

> Chinese gentleman's postings on the syntax of AIA.

Whether you are ahead or behind is not the matter.
The matter is to agree on text to be incorporated in 3280bis.
AFAIK, I have not seen a text proposal for 3280bis.

Denis

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 5 Nov 2004 16:09:52 -0500

Denis,

The briefing proposes solutions and text.  If the 3280 editor accepts the
ideas and text, I will work with him on 3280 revision.

In the mean time, if you have something specific to add, let us know.

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]] 
Sent: Friday, November 05, 2004 9:28 AM
To: Santosh Chokhani
Cc: 'pkix'
Subject: Re: Signer certificate discovery for CRLs

Santosh,

> As I said, we are well ahead of you if you look at my and Stefan's and
> the Chinese gentleman's postings on the syntax of AIA.

Whether you are ahead or behind is not the matter.
The matter is to agree on text to be incorporated in 3280bis. AFAIK, I have
not seen a text proposal for 3280bis.

Denis

> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Denis Pinkas
>  > Just show us how SIA (wherever you want to put it) is more
> efficient  > than AIA for CRL signer.
> 
> Walking on certification paths can be done bottom-up (using AIA
> extensions) or top-down (using SIA extensions).
> 
> [SC: Before we get into path, the purpose of this AIA is simply to get
> the end certificate which protocols such as CMS S/MIME provide]
> 
> It should be RECOMMENDED to place an SIA extension in every CA
> certificate, starting from every Trust Anchor (TA) when the TA is 
> expressed using a self-signed certificate.
> 
> As I already said, information is missing in RFC 3280: we need to say
> more about the formats implied by accessMethod.
> 
> The current text should be clarified whether accessMethod is used in
> an AIA extension or in an SIA extension. Cases 3 and 4 apply to the 
> SIA extension.
> 
> [SC: For both AIA and SIA, at least an HTTP pointer to a p7 file
> containing one or more certificates and pointer to ldap attribute 
> should be permitted.]
>