Subject: 3280bis: suggested words for ambiguous DNs and delegated CRLs

From: "Manger, James H" <[email-masked]>
Date: Mon, 1 Aug 2005 17:34:07 +1000

Change 4.2.1.13 "CRL Distribution Points" to allow non-DN names in the cRLIssuer field and to avoid this field when the CRL issuer only works for one CA.  With any luck this could solve the "ambiguous DN in CRL processing" issue, as well as Denis’s "simplified processing for 'delegated CRLs'".  Replace the last text paragraph in 4.2.1.13 with the following:

"The cRLIssuer field identifies the entity who signs and issues the CRL.  Any CRL it selects must include at least one of the names from cRLIssuer in the CRL’s issuer field or issuerAltName extension.  The CRL MUST also include an issuingDistributionPoint extension with indirectCRL set to TRUE.

A CRL issuer SHOULD use the same DN as the CA if it will only ever cover certificates from that single CA.  This avoids the need for cRLIssuer values in certificates and, more importantly, avoids the need for the indirectCRL flag and certificateIssuer values in critical extensions in CRLs.  A separate name for the CRL issuer can still be included in a CRL via the issuerAltName extension if desired.

It is important that the cRLIssuer field in a certificate unambiguously identifies a single CRL issuer.  A CA MUST only include names in the cRLIssuer field that are unambiguous within the environment where the certificate may be used, which will often mean cRLIssuer names MUST be globally unambiguous.  A globally unambiguous name, such as a DNS name, MUST be used in cRLIssuer when the CRL issuer’s DN is ambiguous."

(There are probably some parts of the CRL processing text that need to change to match this text.)

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 1 Aug 2005 10:47:29 -0400

James Manger,

See responses in-line under [Santosh:]

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Manger, James H
Sent: Monday, August 01, 2005 3:34 AM
To: pkix
Subject: 3280bis: suggested words for ambiguous DNs and delegated CRLs

Change 4.2.1.13 "CRL Distribution Points" to allow non-DN names in the
cRLIssuer field and to avoid this field when the CRL issuer only works for
one CA.

[Santosh: The syntax has always allowed non-DN names.  In terms of avoiding
this field, the standard requires that if the Issuer field in the CRL is not
the same as the Issuer field in the certificate, the certificate issuing CA
assert the CRL Issuer in the CRL DP.  Not doing this can lead to any one
acting as a revocation authority for a CA and that would be bad.]

With any luck this could solve the "ambiguous DN in CRL processing" issue,
as well as Denis's "simplified processing for 'delegated CRLs'".

[Santosh: Having multiple names in the CRL issuer field of CRL DP and
checking them all might reduce the chances of name collision, if that is
what you mean.]

Replace the last text paragraph in 4.2.1.13 with the following:
"The cRLIssuer field identifies the entity who signs and issues the CRL.
Any CRL it selects must include at least one of the names from cRLIssuer in
the CRL's issuer field or issuerAltName extension.

[Santosh: This is not a requirement of the standard today.  The standard
permits the CRL issuer name to be matched to a DP in the IDP.  In
retrospect, the standard should have matched CRL issuer from CRL DP to
issuer field or issuer alt name field in the CRL and matched DPs from CRL DP
and IDP.  That would have been a more appropriate solution.]

The CRL MUST also include an issuingDistributionPoint extension with
indirectCRL set to TRUE.

A CRL issuer SHOULD use the same DN as the CA if it will only ever cover
certificates from that single CA.

[Santosh: This by definition is not an indirect CRL.  This is the case where
the CA is using a different key to sign the CRL.]

This avoids the need for cRLIssuer values in certificates and, more
importantly, avoids the need for the indirectCRL flag and certificateIssuer
values in critical extensions in CRLs.  A separate name for the CRL issuer
can still be included in a CRL via the issuerAltName extension if desired.

[Santosh: While I can support a change in the standard to match CRL issuer
in CRL DP to issuer or issuer alt name in CRL and match the DPs, I do not
want another authority to assert the issuer field in a name and assert its
name in the alt name.]

It is important that the cRLIssuer field in a certificate unambiguously
identifies a single CRL issuer.  A CA MUST only include names in the
cRLIssuer field that are unambiguous within the environment where the
certificate may be used, which will often mean cRLIssuer names MUST be
globally unambiguous.  A globally unambiguous name, such as a DNS name, MUST
be used in cRLIssuer when the CRL issuer's DN is ambiguous."

[Santosh: Requiring a unique DNS may be fine.  But, CA does not know the
trust anchors environment of the relying parties to know if the CRL issuer
DN will be unambiguous.]

(There are probably some parts of the CRL processing text that need to
change to match this text.)

---

From: "David A. Cooper" <[email-masked]>
Date: Mon, 01 Aug 2005 12:25:45 -0400

Santosh,

Actually, the standard DOES require that the name in the cRLIssuer field 
match one of the names in the issuer field of issuerAltName extension of 
the CRL.

In RFC 3280 (and 3280bis), section 6.3.3 step (b)(1) states:

         (1)  If the DP includes cRLIssuer, then verify that the issuer
         field in the complete CRL matches cRLIssuer in the DP and that
         the complete CRL contains an issuing distribution point
         extension with the indirectCRL boolean asserted.  Otherwise,
         verify that the CRL issuer matches the certificate issuer.

It is true that according to section 6.3.3 step (b)(2), if the CRL 
contains an IDP extension with a distribution point name and the 
distribution point in the CDP extension of the certificate includes a 
cRLIssuer field but does not include a distribution point name, then the 
contents of the cRLIssuer field can be compared to the distribution 
point name in the IDP extension in the CRL.  However, this does not 
eliminate the requirement from step (b)(1) to for the issuer field (or 
issuerAltName extension) in the CRL to include a name that matches the 
contents of the cRLIssuer field in the CDP extension.

Dave

---

From: "David A. Cooper" <[email-masked]>
Date: Mon, 01 Aug 2005 12:42:20 -0400

>A CRL issuer SHOULD use the same DN as the CA if it will only ever cover certificates from that single CA.  This avoids the need for cRLIssuer values in certificates and, more importantly, avoids th…
I think we need to be careful about saying that this method "SHOULD" be 
used.  While it is interesting to note that one can delegate CRL issuing 
to a different system without the use of indirect CRLs, it may not be 
considered appropriate for the CRL issuer to use the same name as the 
certificate issuer if the two systems are being run by different 
organizations.  Even if there is a decision to point out in 3280bis that 
it is possible to delegate the issuance to CRLs to a different system 
without using indirect CRLs, I think such guidance should go in section 
5 rather than section 4.2.1.13.

>It is important that the cRLIssuer field in a certificate unambiguously identifies a single CRL issuer.  A CA MUST only include names in the cRLIssuer field that are unambiguous within the environme…
I have a problem with this paragraph since X.509 requires that ALL names 
be unambiguous.  Including language such as this implies that it is OK 
to use ambiguous names expect in cases such as this.  If a CA or CRL 
issuer can have a DNS name that is globally unambiguous, then it can 
certainly use domainComponent naming to construct a DN is that unambiguous.

Dave

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 1 Aug 2005 13:35:26 -0400

David,

I stand corrected.

For what it is worth, X.509 does not seem to have rules for matching issuer
alt name.

Given the syntax of CRL issuer field in CRL DP (General Names), it is
logical that non-DN names will be matched with the issuer alt name.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of David A. Cooper
Sent: Monday, August 01, 2005 12:26 PM
Cc: pkix
Subject: Re: 3280bis: suggested words for ambiguous DNs and delegated CRLs

Santosh,

Dave

Santosh Chokhani wrote:

>From: [email-masked] 
>[mailto:[email-masked]] On Behalf Of Manger, James H
>Replace the last text paragraph in 4.2.1.13 with the following: "The 
>cRLIssuer field identifies the entity who signs and issues the CRL. Any 
>CRL it selects must include at least one of the names from cRLIssuer in 
>[Santosh: This is not a requirement of the standard today.  The 
>standard permits the CRL issuer name to be matched to a DP in the IDP.  
>In retrospect, the standard should have matched CRL issuer from CRL DP 
>to issuer field or issuer alt name field in the CRL and matched DPs 
>from CRL DP and IDP.  That would have been a more appropriate 
>solution.]
>