Subject: RE: straw poll on certs in CRLs

From: Paul Hoffman <[email-masked]>
Date: Wed, 7 Mar 2007 11:32:13 -0800

At 2:20 PM -0500 3/7/07, Guida, Richard [JJCUS] wrote:
>Paul - perhaps I am missing something here (would not be the first 
>time...) but the proposal is that it be a non-critical extension and 
>as such, under RFC3280, relying party software can indeed ignore it 
>if they fail to recognize it, correct?

Yes, definitely. But that's not the concern of many of the "no" folks 
have voiced.

>  Your e-mail said "turned it on" but I was not clear what you meant by that.

Good point; I should have said "deployed, perhaps by default".

Issuing CRLs with this extension causes the CRL to grow, possibly 
significantly. Transmitting this kruft in every CRL retrieval, 
particularly in protocols that require CRL retrieval, is wasteful. 
Further, other folks have proposed better solutions that allow more 
useful information to be given to the relying party than the 
one-size-fits-all view that the CRL issuer knows all possible chains 
it should include in the CRL.

--Paul Hoffman, Director
--VPN Consortium

---

From: "Guida, Richard [JJCUS]" <[email-masked]>
Date: Wed, 7 Mar 2007 14:20:52 -0500

Paul - perhaps I am missing something here (would not be the first time...)
but the proposal is that it be a non-critical extension and as such, under
RFC3280, relying party software can indeed ignore it if they fail to
recognize it, correct?  Your e-mail said "turned it on" but I was not clear
what you meant by that.  Just trying to ensure I understand the calculus
here.  Thanks very much -- Rich

Richard A. Guida
Director, Information Security

Johnson & Johnson
Room GS8217
410 George Street
New Brunswick, New Jersey  08901
Phone:  732 524 3785

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Paul Hoffman
Sent: Wednesday, March 07, 2007 11:59 AM
To: Stefan Santesson; [email-masked]
Subject: RE: straw poll on certs in CRLs

At 11:07 AM +0000 3/7/07, Stefan Santesson wrote:
>I would like to see a standard, but I'm not locked on document type. 
>But I don't think that is what this straw-poll is about. IMO it is 
>if pkix should develop the feature at all.

Please re-read the poll that your co-chair wrote:

Should PKIX develop a standard for a non-critical CRL extension that 
can hold one or more certs for use in validating the CRL in question?

That is quite clearly about the proposed solution being in CRLs, not 
about the feature.

>This is a feature that you can't ram down anybody's throat.

Fully disagree. If a significant vendor of software used as CAs 
started putting such an extension in its software and turned it on by 
default, it would be rammed down the throats of every system that 
validated using CRLs. As many people have pointed out, putting the 
extra information in the CRL makes it so that there is no 
negoitiation on the recipient's part about whether or not they want 
it, need it, or can even understand it.

--Paul Hoffman, Director
--VPN Consortium