Subject: WG Last Call: CRL Schema

From: Tim Polk <[email-masked]>
Date: Mon, 15 Nov 2004 17:26:40 -0500

This message initiates working group Last Call for the "LDAP Schema for 
X.509 CRLs" specification. The editors have confirmed that all working 
group issues have been resolved.

The URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-pkix-ldap-crl-schema-03.txt

This specification has also been forwarded to the LDAP Directorate for a 
parallel review.  Assuming successful Last Call and concurrence from the 
LDAP Directorate, this document will be forwarded to the ADs for 
consideration as an Informational track RFC.

Last Call will run for (at least) two weeks. That is, Last Call will not 
close before November 29.

Thanks,

Tim Polk

---

From: Andrew Sciberras <[email-masked]>
Date: Fri, 19 Nov 2004 15:02:59 +1100

Hi,

In Section 2 - 'DIT Structure and Naming', the x509CRLentryNameForm
Name Frm is defined.
This makes reference to an attribute called x509serial. Is this
supposed to read x509serialNumber?

An entry with a x509CRLentry Object Class must contain an
x509serialNumber attribute within the entry. This attribute must be
used as a naming attribute as well. CRL's can contain many revoked
certificate serial numbers. So, why would you use a serial number to
form the RDN? Do you simply pick one revoked serial number at random
to use as the distinguished value?
OR, is this serial number refering to the serial number of the issued
CRL? Which is counter to the description of x509serialNumber provided
in Section 4...

Regards,
Andrew Sciberras,

---

From: David Chadwick <[email-masked]>
Date: Thu, 25 Nov 2004 19:21:21 +0000

Hi Andrew

> supposed to read x509serialNumber?

yes you are correct. This is a typo. It should refer to x509serialNumber 
defined in the PKC schema ID. ie.
it is the serial number of the revoked certificate whose entry this is.

> certificate serial numbers. 

Correct, and you can choose to represent each revoked certificate as a 
separate entry, of type x509CRLentry object class.

So, why would you use a serial number to
> form the RDN? 

You are getting confused. This is not the name of the CRL object. CRL 
objects are named with the x509CRLThisUpdate attribute, which is unique 
for each CRL. This is the name of the CRL entry object, and there is 
optionally one of these for each revoked certificate.

regards

David

Do you simply pick one revoked serial number at random

-- 

*****************************************************************

David W. Chadwick, BSc PhD
Professor of Information Systems Security
IS Institute, University of Salford, Salford M5 4WT
Tel: +44 161 295 5351  Fax +44 1484 532930
Mobile: +44 77 96 44 7184
Email: [email-masked]
Home Page:  http://www.salford.ac.uk/its024/chadwick.htm
Research Web site: http://sec.isi.salford.ac.uk
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************