Subject: Re: Operational Protocols - LDAPv3

From: "David P. Kemp" <[email-masked]>
Date: Fri, 7 Jul 2000 10:57:10 -0400 (EDT)

> From: Rich Salz <[email-masked]>
>
> > 6. Security Considerations
> > 
> > The PKI information to be retrieved from LDAPv3 servers (certificates
> > and CRLs) is digitally signed and therefore additional integrity
> > services are NOT REQUIRED.
> 
> I think it's worth adding a warning that clients who retrieve CRLs
> without some way of verifying the server run the risk of being sent
> an obsolete CRL.
> 	/r$

A CRL includes a nextUpdate field which allows a client to know whether
a scheduled replacement has been issued.  What benefit is there to
verifying the server?  Propogation delays will cause even a "good"
server to send out an "obsolete" CRL after a replacement (scheduled or
unscheduled) has been issued.

Clients should have a security policy that determines, possibly based
on transaction value and possibly though not necessarily based on
nextUpdate, how long after "thisUpdate" a CRL can be used.  That policy
shouldn't have anything to do with the trustworthiness or reliability
of any LDAP servers.

Dave

---

From: Rich Salz <[email-masked]>
Date: Fri, 07 Jul 2000 12:21:44 -0400

> verifying the server?

The issue here would be unscheduled.

The fact that you wrote something indicates the need for the caveat. :)

>  That policy

If a cert has a CRLDP that points to a repository, shouldn't the client
policy be to verify that it's got the right repository?

This seems to be a subtle point missed by many, hence my suggested
addition.
	/r$