Subject: Re: Operational Protocols - LDAPv3

From: "David P. Kemp" <[email-masked]>
Date: Fri, 7 Jul 2000 13:55:35 -0400 (EDT)

> From: Rich Salz <[email-masked]>
> 
> If a cert has a CRLDP that points to a repository, shouldn't the client
> policy be to verify that it's got the right repository?

Nope.  The CRLDP certificate extension says:

  "The same name, in at least one of its name forms, shall be present
  in the distributionPoint field of the issuing distribution point
  extension of the CRL."

Thus the signed certificate and the signed CRL are linked together by
a common distribution point name.  Whether the CRL came from the named
repository, a different repository, a cache entry, or a floppy disk
doesn't matter.

I agree that the fact that CRLDP is used for two unrelated purposes -
pointing to a repository and partitioning CRLs - is a subtle point.

---

From: Rich Salz <[email-masked]>
Date: Fri, 07 Jul 2000 14:19:00 -0400

> a common distribution point name.

And if the CRLDP has a name like "pkix-ldap.foo.com", then an adversary
need only spoof DNS to get the client to go somewhere else, get valid --
albeit STALE -- data, and will erroneously proceed, no?
	/r$