Subject: Re: straw poll on certs in CRLs

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 6 Mar 2007 11:56:43 +0100

NO.

Discussion: as currently proposed, the extension does not make it
possible to distinguish (prior to retrieval) between a CRL
containing certificates and a normal CRL.  

The ability for a consumer to retrieve a normal CRL must be a requirement
for this work item.

Denis

---

From: Koen Simoens <[email-masked]>
Date: Tue, 6 Mar 2007 13:30:21 +0100 (CET)

No

On Mon, 5 Mar 2007, Stephen Kent wrote:
>
> Folks,
>
> In the last few weeks I have seen a number of messages supporting the
> notion of a CRL extension that would enable a CA to include a CA cert
> (or certs) in a CRL.  Earlier we had some traffic on this topic, but is
> was all negative. So, it seem like its time for a straw poll, so we can
> gauge WG consensus. Since Stefan is a proponent of this notion, I will
> conduct the poll.
>
> Plesse send a message to the list (indicating YES or NO) on the
> following question:
>
> Should PKIX develop a standard for a non-critical CRL extension that can
> hold one or more certs for use in validating the CRL in question?
>
> The poll begins today, and will close on March 16. I will, announce the
> results during the PKIX session at the IETF meeting in Prague.
>
> Steve

Disclaimer: http://www.kuleuven.be/cwis/email_disclaimer.htm

---

From: "Dave Engberg" <[email-masked]>
Date: Tue, 6 Mar 2007 08:17:12 -0500

Yes.

----- Original Message -----
From: [email-masked] <[email-masked]>
To: [email-masked] <[email-masked]>
Sent: Mon Mar 05 12:05:52 2007
Subject: straw poll on certs in CRLs

Folks,

In the last few weeks I have seen a number of messages supporting the 
notion of a CRL extension that would enable a CA to include a CA cert 
(or certs) in a CRL.  Earlier we had some traffic on this topic, but 
is was all negative. So, it seem like its time for a straw poll, so 
we can gauge WG consensus. Since Stefan is a proponent of this 
notion, I will conduct the poll.

Should PKIX develop a standard for a non-critical CRL extension that 
can hold one or more certs for use in validating the CRL in question?

The poll begins today, and will close on March 16. I will, announce 
the results during the PKIX session at the IETF meeting in Prague.

Steve

---

From: "Carlos Gonzalez-Cadenas" <[email-masked]>
Date: Tue, 6 Mar 2007 16:15:45 +0100

No.

---

From: "Guida, Richard [JJCUS]" <[email-masked]>
Date: Wed, 7 Mar 2007 18:23:07 -0500

Paul - o.k. thanks, that lays things out well.  One final point then I
promise to stop punishing everyone with my postings on this topic.  In a
general case solution where (as you say) you are not certain about who your
relying parties may be, I can see that it could get cumbersome and complex
for the CA to try to figure out all the certs that may belong in the
extension.  In a more restricted circumstance - such as use within an
enterprise (not just my enterprise but any enterprise) or use with a
specific set of known relying parties who are bound by contract - things are
likely to be much easier and less cumbersome.

Anyway - thanks again for your insights on this - appreciate them very much.
Very best regards -- Rich

Richard A. Guida
Director, Information Security

Johnson & Johnson
Room GS8217
410 George Street
New Brunswick, New Jersey  08901
Phone:  732 524 3785

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Paul Hoffman
Sent: Wednesday, March 07, 2007 3:16 PM
To: [email-masked]
Subject: RE: straw poll on certs in CRLs

At 3:01 PM -0500 3/7/07, Guida, Richard [JJCUS] wrote:
>Paul - thanks very much, that indeed helps clarify things.  One 
>final question then: if the concern is that the extension may hold 
>one or a few certs, and since a typical cert may be 1K or 2K in size 
>(mine is 1.4K DER-encoded), how much bloat do you anticipate in a 
>typical CRL?

We don't know, and that's one of the problems with the proposed 
design. The certs are to help validating parties make chains. The CRL 
issuer doesn't know all the relying parties at the time it creates 
the CRL, and therefor must make the worst-case guess about which 
chains to add.

>If the proposal were to limit the number of certs in the extension 
>to a small number - say 10 at most - then might that ameliorate 
>concerns?

Yes, but it would also not fulfill the purpose of the proposed 
design. A different design could handle many more chains without 
burdening the relying party at all (except at the times that they 
choose to do chain validation).

--Paul Hoffman, Director
--VPN Consortium