Subject: CRL SCOPE in rfc3280

From: [email-masked]
Date: Wed, 17 Nov 2004 23:21:09 +0100

Hi,

In rfc 3280 say about distribution point: 

If the distributionPoint field is absent, the CRL MUST contain entries for all revoked unexpired certificates issued by the CRL issuer, if any, within the scope of the CRL.

Can someone explain to me what mean the last part of the sentence exactly in this context? The part 'within the scope of the CRL'. I would have wrote :

If the distributionPoint field is absent, the CRL MUST contain entries for all revoked unexpired certificates issued by the CRL issuer, if any.

Thanks...

Marc

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Thu, 18 Nov 2004 12:25:46 +0800

Marc,

By "the scope of the CRL", it means the scope specified by
the onlyContainsUserCerts flag, the onlyContainsCACerts flag, the
onlySomeReasons flags, the indirectCRL flag, and the
onlyContainsAttributeCerts flag, if any, in the same IDP extension.

(Please note that the new X.509 Technical Corrigendum 3 had already
remove onlyContainsAttributeCerts flag from IDP extension.)

With legal combinations of these flags, you can specify different scope of the CRL.
For example, an IDP extension with onlyContainsUserCerts = TRUE and
onlySomeReasons contains keyCompromise and cACompromise flags means
that the CRL scope only covers  EE certificates revoked by the reasons of Key
Compromise or CA Compromise.

With distributionPoint field absent, it means the the CRL issuer must guarantee
that all revoked unexpired certificates within that scope must be listed in
that CRL.

With distributionPoint field present, it means that the CRL might be a "partitioned"
CRL of that scope.

If there is no any flags in the IDP extension, it means the scope covers all revoked
unexpired certificates (include CA certificatee and EE certificates revoked by any
reason). However, it might be "partitioned" (depend on whether distributionPoint field
present)

If there is no IDP extension, it means the scope covers all revoked
unexpired certificates and it is not a "partitioned" CRL. That means
it is a full CRL.

Therefore, the part 'within the scope of the CRL' in that statement should not
be removed.

Wen-Cheng Wang
  ----- Original Message ----- 
  From: [email-masked] 
  To: [email-masked] 
  Sent: Thursday, November 18, 2004 6:21 AM
  Subject: CRL SCOPE in rfc3280

  Hi,

  Thanks...

  Marc