Subject: straw poll on certs in CRLs

From: Stephen Kent <[email-masked]>
Date: Mon, 5 Mar 2007 12:05:52 -0500

Folks,

In the last few weeks I have seen a number of messages supporting the 
notion of a CRL extension that would enable a CA to include a CA cert 
(or certs) in a CRL.  Earlier we had some traffic on this topic, but 
is was all negative. So, it seem like its time for a straw poll, so 
we can gauge WG consensus. Since Stefan is a proponent of this 
notion, I will conduct the poll.

Plesse send a message to the list (indicating YES or NO) on the 
following question:

Should PKIX develop a standard for a non-critical CRL extension that 
can hold one or more certs for use in validating the CRL in question?

The poll begins today, and will close on March 16. I will, announce 
the results during the PKIX session at the IETF meeting in Prague.

Steve

---

From: Russ Housley <[email-masked]>
Date: Mon, 05 Mar 2007 15:21:52 -0500

>can hold one or more certs for use in validating the CRL in question?

No.

Russ

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Mon, 05 Mar 2007 21:09:31 +0100

> can hold one or more certs for use in validating the CRL in question?
No.
A pkcs#7 including  the needed CRL and certificat is better suited than 
a new extension. 
There's no significant overhead to this format WRT a crl with the cert 
in  an extension.

---

From: Tilo Kienitz <[email-masked]>
Date: Mon, 05 Mar 2007 21:50:48 +0100

Yes.

-- 
Tilo Kienitz
SecCommerce Informationssysteme GmbH
D - 22335 Hamburg

Stephen Kent wrote:
> (or certs) in a CRL.  Earlier we had some traffic on this topic, but is 
> was all negative. So, it seem like its time for a straw poll, so we can 
> gauge WG consensus. Since Stefan is a proponent of this notion, I will 
> conduct the poll.
> 
> Should PKIX develop a standard for a non-critical CRL extension that can 
> hold one or more certs for use in validating the CRL in question?
> 
> The poll begins today, and will close on March 16. I will, announce the 
> results during the PKIX session at the IETF meeting in Prague.
> 
> Steve

---

From: "Kemp, David P." <[email-masked]>
Date: Mon, 5 Mar 2007 15:25:03 -0500

NO.

Discussion: as currently proposed, the extension does not make it
possible to distinguish (prior to retrieval) between a CRL
containing certificates and a normal CRL.  The ability for a
consumer to retrieve a normal CRL must be a requirement
for this work item.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stephen Kent
Sent: Monday, March 05, 2007 12:06 PM
To: [email-masked]
Subject: straw poll on certs in CRLs

Folks,

Steve

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 5 Mar 2007 14:08:57 -0800

No. This will cause issuers to not know which CRL to send (the small 
one or the big one) and therefore they will always send the big one. 
The requirement is much better deal with by a different structure 
that bundles a CRL with the needed certs.

--Paul Hoffman, Director
--VPN Consortium

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Tue, 6 Mar 2007 11:04:19 +0800

No.

Wen-Cheng Wang

---

From: Yoav Nir <[email-masked]>
Date: Mon, 5 Mar 2007 22:06:00 -0500

I say no.

The same LDAP server, HTTP server or whatever that serves the CRL can  
also serve the CA cert if needed.

On Mar 5, 2007, at 12:05 PM, Stephen Kent wrote:

>
> Folks,
>
> In the last few weeks I have seen a number of messages supporting  
> the notion of a CRL extension that would enable a CA to include a  
> CA cert (or certs) in a CRL.  Earlier we had some traffic on this  
> topic, but is was all negative. So, it seem like its time for a  
> straw poll, so we can gauge WG consensus. Since Stefan is a  
> proponent of this notion, I will conduct the poll.
>
> Should PKIX develop a standard for a non-critical CRL extension  
> that can hold one or more certs for use in validating the CRL in  
> question?
>

---

From: "Manger, James H" <[email-masked]>
Date: Tue, 6 Mar 2007 15:42:39 +1100

Yes

> Should PKIX develop a standard for a non-critical CRL extension that can hold one or more certs for use in validating the CRL in question?

---

From: "Tobias Gondrom" <[email-masked]>
Date: Tue, 6 Mar 2007 10:14:19 +0100

No. 

Tobias

> Sent: Monday, March 05, 2007 6:06 PM
> To: [email-masked]

---

From: Johannes Merkle <[email-masked]>
Date: Tue, 06 Mar 2007 11:32:39 +0100

Yes

Johannes

---

From: "Peter Rybar" <[email-masked]>
Date: Tue, 6 Mar 2007 15:21:56 +0100

NO.

I agree with Jean-Marc Desperrier about PKCS#7 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of 
Sent: Monday, March 05, 2007 9:10 PM
To: Stephen Kent; pkix
Subject: Re: straw poll on certs in CRLs

No.

---

From: Alfredo Esposito <[email-masked]>
Date: Tue, 06 Mar 2007 16:26:20 +0100

No

Stephen Kent wrote:
> is was all negative. So, it seem like its time for a straw poll, so we 
> can gauge WG consensus. Since Stefan is a proponent of this notion, I 
> will conduct the poll.
>

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 6 Mar 2007 16:00:04 +0000

And my obvious vote (with pkix chair hat off of course) is:

Yes.

Stefan Santesson
Senior Program Manager
Windows Security, Standards

> From: [email-masked] [mailto:owner-ietf-
> [email-masked]] On Behalf Of Stephen Kent
> Sent: den 5 mars 2007 18:06
> To: [email-masked]

---

From: Robert Kisteleki <[email-masked]>
Date: Tue, 06 Mar 2007 20:21:46 +0100

No.

Robert

---

From: "Sharon Boeyen" <[email-masked]>
Date: Tue, 6 Mar 2007 14:10:27 -0500

No

-----Original Message-----

Folks,

Steve

---

From: "Michael Myers" <[email-masked]>
Date: Tue, 6 Mar 2007 10:48:51 -0800

No.

Mike

---

From: "Turner, Sean P." <[email-masked]>
Date: Wed, 7 Mar 2007 15:50:07 -0500

no - spt 
 
> Should PKIX develop a standard for a non-critical CRL 
> extension that can hold one or more certs for use in 
> validating the CRL in question?
>

---

From: Michael Ströder <[email-masked]>
Date: Mon, 12 Mar 2007 21:39:36 +0100

No.

Ciao, Michael.