Subject: RE: cA flag and CRL issuers (was Re: Last Call: draft-ietf-pkix -new-part1-06.txt comments)

From: Hal Lockhart <[email-masked]>
Date: Thu, 17 May 2001 09:42:26 -0400

>Stephen Kent wrote:

> One might be able to retain the definitions of CA and AA and add a 
> new authority, but I think it probably would be clearer to refine the 
> CA and AA definitions to make it clear that these entities may 
> explicitly authorize another, newly named authority type, to issue 
> just CRLs.

The obvious name is Revocation Authority. Unfortunately we already have an
R.A.

Hal

---

From: "Housley, Russ" <[email-masked]>
Date: Thu, 24 May 2001 15:53:57 -0400

It has never been my intent to add any new entities to the Internet PKI 
model.  The CA is responsible for maintaining revocation status information 
about the certificates that it issues.  The indirect CRL mechanism allows 
the CA to delegate the issuing of CRLs that cover all or some portion of 
those certificates to another CA.  We still call it a CA even if it never 
issues any certificates, only CRLs.

Russ

---

From: Tony Bartoletti <[email-masked]>
Date: Thu, 24 May 2001 13:44:33 -0700

At 03:53 PM 5/24/01 -0400, Housley, Russ wrote:
>model.  The CA is responsible for maintaining revocation status 
>information about the certificates that it issues.  The indirect CRL 
>mechanism allows the CA to delegate the issuing of CRLs that cover all or 
>some portion of those certificates to another CA.  We still call it a CA 
>even if it never issues any certificates, only CRLs.
>
>Russ

Since the designation "CA" is specifically a PKC-CA (correct me otherwise,) 
your statement does not address AAs.

In parallel logic, would it be correct to say when an Attribute Authority 
delegates the issue of "Attribute CRLs" to another party, that other party 
is thus to be called an AA, even though it may not issue attribute 
certificates?

And does an AA have ability to enforce this delegation (via key usage 
flags, etc) in parallel to the mechanisms afforded a PKC-CA?

___tony___

Tony Bartoletti 925-422-3881 <[email-masked]>
Information Operations, Warfare and Assurance Center
Lawrence Livermore National Laboratory
Livermore, CA 94551-9900