Subject: 3280bis: indirectCRL boolean in IDP (3/3)

From: Denis Pinkas <[email-masked]>
Date: Sat, 13 Nov 2004 14:59:54 +0100

3280bis: indirectCRL boolean in IDP (3/3)

This is a change and an addition proposal related to indirect CRLs.

From section 5.2.5 Issuing Distribution Point, "the CRL issuer MUST
assert the indirectCRL boolean, if the scope of the CRL includes
certificates issued by authorities other than the CRL issuer".

This sentence is incorrect since CRL issuers do not issue
certificates.  

Proposed correction: 

"The CRL issuer MUST assert the indirectCRL boolean, if the scope of
the CRL includes certificate identifiers from multiple authorities"
 
This boolean indicates a type b) indirect CRL but is named indirectCRL
boolean which is confusing with type a) indirect CRLs.

A note should be mentioned to clarify the ambiguity of the naming.

Proposed note: 

"The name of the boolean "indirectCRL" designates an indirect CRL that
includes certificate identifiers from multiple authorities, and not an
indirect CRL that includes certificate identifiers from a single CA.
An alternative name for that boolean would be: multipleCAs."

Denis

---

From: "Manger, James H" <[email-masked]>
Date: Mon, 15 Nov 2004 14:44:42 +1100

The indirectCRL field should not be redefined.
CRL issuers do issue certificates if they are also CAs (as they often
are).
The indirectCRL field does not only indicate a "type b) indirect CRL" --
it must also be set to true for a "type a) indirect CRL".

Proposed action: don't accept Denis's proposed correction or proposed
note.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Denis Pinkas
Sent: Sunday, 14 November 2004 1:00 AM
To: [email-masked]
Cc: pkix
Subject: 3280bis: indirectCRL boolean in IDP (3/3)

This sentence is incorrect since CRL issuers do not issue certificates.

Proposed correction: 

"The CRL issuer MUST assert the indirectCRL boolean, if the scope of the
CRL includes certificate identifiers from multiple authorities"

Proposed note: 

Denis