Subject: Re: IESG last call changes to the CRL AIA draft

From: Denis Pinkas <[email-masked]>
Date: Sun, 18 Sep 2005 16:31:54 +0200

David,
 
Thank you for the explanations. The current text addition proposal is 
the following:
 
"When different public keys are used to validate signatures on 
certificates and CRLs,
the desired certificate is stored in the userCertificate attribute as 
specified in [RFC 2587]".
 
Along the lines of your explanations, I would propose:
 
"When the certificate pointed to by the AIA extension in the CRL is only 
used to verify
signatures on CRLs, but not signatures on certificates (i.e. different 
public keys are used
to validate signatures on certificates and CRLs), the desired 
certificate is stored in the
userCertificate attribute as specified in [RFC 2587]".
 
Denis

---

From: "Santosh Chokhani" <[email-masked]>
Date: Sun, 18 Sep 2005 11:52:54 -0400

This statement is incomplete and possibly misleading.  Indirect CRL issuer
(when the ICRL Authority) is not a CA, its certificate will also have these
characteristics.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Denis Pinkas
Sent: Sunday, September 18, 2005 10:32 AM
To: David A. Cooper
Cc: pkix; Sam Hartman
Subject: Re: IESG last call changes to the CRL AIA draft

David,

 

Denis

---

From: Sam Hartman <[email-masked]>
Date: Sun, 18 Sep 2005 12:07:41 -0400

>>>>> "Denis" == Denis Pinkas <[email-masked]> writes:

    Denis> David, Thank you for the explanations. The current text
    Denis> addition proposal is the following: "When different public
    Denis> keys are used to validate signatures on certificates and
    Denis> CRLs, the desired certificate is stored in the
    Denis> userCertificate attribute as specified in [RFC 2587]".
    Denis> Along the lines of your explanations, I would propose:

    Denis> attribute as specified in [RFC 2587]".  Denis

Denis, the proposed text is no longer proposed.  The document has been
approved and sent to the rfc editor.