Subject: RE: IDP indirectCRL flag

From: "Manger, James H" <[email-masked]>
Date: Mon, 1 Aug 2005 16:31:38 +1000

> When a CA wants to delegate to another entity the responsibility
> to issue revocation status information, the conditions are negotatied.

I agree.

> Among the conditions, the CRL Issuer will have to accept to work
> (under a given name) only for that single CA...
> If the CRL Isssuer does not accept, then the CRL Issuer certificate
> is not issued.

Ahhhhh.  I understand that some CRL issuers would agree to work only for a single CA.  I didn't realise you were mandating this new rule for all CRL issuers.  If you could mandate this new rule for all CRL issuers then Denis's rules could work.

The problem is that trying to mandate an additional rule for all CRL issuers over and above X.509, RFC2459 & RFC3280 (even to existing CRL issuers and to authorities not claiming compliance to RFC3280bis) is untenable.

Currently, a CA can issue a CRL just for its own certificates (without IDP) regardless of whether it issues revocation information for 0, 1 or more other CAs.  Denis's rules would forbid this (without actually saying so!) as such a CRL would be ambiguous.  A relying party could not tell if the listed certificate numbers were from the authority that issued the CRL or from any authority that issued a CRL issuer certificate to that authority.  Denis's rules also forbid a CRL issuer being certified by more 2 or more CAs, as that would also cause ambiguity.

Another way to tell how awkward Denis's rules make CRL processing is to consider a simple CA that issues its own CRLs.  It has a certificate from a parent CA with the cRLSign bit set.  It issues CRLs without IDP.  A "standard" relying party seeing this certificate and CRL would know straight away which certificates are revoked.  A relying party implementing Denis's rule would not.  It cannot tell if the CRL issuer is revoking its own certificates or acting as delegate for another CA.  This confusion might be resolved once the CRL matches a certificate, but you have already complicated the software and lost some opportunities for optimisation.