Subject: Re: Empty CRL Issuer DNs?

From: "David A. Cooper" <[email-masked]>
Date: Thu, 01 Mar 2007 08:59:03 -0500

Sean Mullan wrote:
> MUST the CRL issuer field always contain a non-empty DN under RFC 
> 3280? On my reading, this would appear to be the case, but the RFC 
> never explicitly says so like it does for the Certificate issuer 
> field. Either way, it would be nice if this was clarified for 3280-bis.
Yes, the CRL issuer field MUST include a non-empty DN.

Section 5.1.2.3 of 3280/3280bis simply says that "[t]he issuer name 
field MUST contain an X.500 distinguished name (DN)."  It is my guess 
that this was intended to mean a non-empty DN, otherwise there would 
have been no reason to use a capitalized "MUST" since the CRL syntax 
requires that the issuer field include a DN.

There is a statement in section 4.1.2.6 (Subject) of 3280/3280bis that 
does more clearly indicate that the issuer field in a CRL must include a 
non-empty DN:
   
      If the subject is a CRL issuer (e.g., the key usage extension, as
      discussed in 4.2.1.3, is present and the value of cRLSign is TRUE)
      then the subject field MUST be populated with a non-empty
      distinguished name matching the contents of the issuer field
      (section 4.1.2.4) in all CRLs issued by the subject CRL issuer.

I agree that it would make sense to modify the sentence in 5.1.2.3 to 
read:  The issuer name field MUST contain a non-empty X.500 
distinguished name (DN).

Dave

---

From: Russ Housley <[email-masked]>
Date: Thu, 01 Mar 2007 12:37:29 -0500

I think it does require a non-empty DN by referring to section 4.1.2.4.

Russ

At 05:23 PM 2/28/2007, Sean Mullan wrote:

>Hello,
>Thanks,
>Sean

---

From: Stefan Santesson <[email-masked]>
Date: Fri, 2 Mar 2007 12:38:50 +0000

David,

I think you can safely just add this to the list of editorial nits to be added to the next update. Or for the unlikely event there will be no update, to Authors 48.
There is no doubt that a non-empty DN is already required.

Stefan Santesson
Senior Program Manager
Windows Security, Standards

> -----Original Message-----
> From: [email-masked] [mailto:owner-ietf-
> [email-masked]] On Behalf Of David A. Cooper
> Sent: den 1 mars 2007 14:59
> To: Sean Mullan; pkix
> Subject: Re: Empty CRL Issuer DNs?
>
>
> Sean Mullan wrote: