Subject: RE: IESG last call changes to the CRL AIA draft

From: "Stefan Santesson" <[email-masked]>
Date: Mon, 19 Sep 2005 10:15:34 +0100

Process wise this document is approved by IESG and is currently in the
RFC editors queue.

On the fact I don't see any reason to change the current text. The
current text is correct and expresses the relevant conclusion, that is,
one must be prepared to look in all the 3 listed attributes when using
the directoryName form of accessLocation.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security
 
> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Santosh Chokhani
> Sent: den 18 september 2005 17:53
> To: 'pkix'; 'Sam Hartman'
> Subject: RE: IESG last call changes to the CRL AIA draft
> 
> 
> This statement is incomplete and possibly misleading.  Indirect CRL
issuer
> (when the ICRL Authority) is not a CA, its certificate will also have
> these
> characteristics.
> 
> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On
> Behalf Of Denis Pinkas
> Sent: Sunday, September 18, 2005 10:32 AM
> To: David A. Cooper
> Cc: pkix; Sam Hartman
> Subject: Re: IESG last call changes to the CRL AIA draft
> 
> 
> 
> David,
> 
> Thank you for the explanations. The current text addition proposal is
> the following:
> 
> "When different public keys are used to validate signatures on
> certificates and CRLs,
> the desired certificate is stored in the userCertificate attribute as
> specified in [RFC 2587]".
> 
> Along the lines of your explanations, I would propose:
> 
> "When the certificate pointed to by the AIA extension in the CRL is
only
> used to verify
> signatures on CRLs, but not signatures on certificates (i.e. different
> public keys are used
> to validate signatures on certificates and CRLs), the desired
> certificate is stored in the
> userCertificate attribute as specified in [RFC 2587]".
> 
> Denis

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 19 Sep 2005 07:55:12 -0400

Stefan,

I fully agree with you.

I was try to point out to Denis that there is more than one circumstance for
the certificate not being a "CA certificate".

-----Original Message-----
From: Stefan Santesson [mailto:[email-masked]] 
Sent: Monday, September 19, 2005 5:16 AM
To: Santosh Chokhani; pkix; Sam Hartman
Subject: RE: IESG last call changes to the CRL AIA draft

Process wise this document is approved by IESG and is currently in the RFC
editors queue.

On the fact I don't see any reason to change the current text. The current
text is correct and expresses the relevant conclusion, that is, one must be
prepared to look in all the 3 listed attributes when using the directoryName
form of accessLocation.

Stefan Santesson
 
issuer
> these characteristics.
> certificates and CRLs, the desired certificate is stored in the 
only
> public keys are used to validate signatures on certificates and CRLs), 
> the desired certificate is stored in the