Subject: Re: cA flag and CRL issuers

From: Tony Bartoletti <[email-masked]>
Date: Wed, 30 May 2001 11:43:49 -0700

At 10:10 AM 5/30/01 -0400, you wrote:
>3) An authority stands up on its own with no CA blessing, and overtly claims
>that it will not reflect the CA's revocation status, but instead will reflect
>some local policy such as an employee's right to access company assets.
>
>By dictionary and common sense, #3 is not a "Certificate Revocation List",
>it is an "Access Control List".  You and Tony argue that it is a good idea
>to mix authentication and access control because such mixing is expedient --
>products support revocation of authentication credentials but do not widely
>support access control.  You further argue that the PKIX path validation
>algorithm should be modified to officially sanction the merging of
>authentication and access control.
>
>I argue that such merging (done unofficially) is a bad idea from a security
>point of view, and it would be an even worse idea to modify X.509 and
>PKIX to officially support non-CA-authorized CRL signers.

Dave,

I agree that mixing (identity) authentication and authorization is bad 
(however expedient.)

My issue, perhaps academic, was not one of authorization.  I intend that 
the RP (or RP organization) unilaterally declares that binding of identity 
(DN) to key is voided.  The net result might not be the same regarding 
authorization.  If an "identity" binding fails, there may be myriad 
separate authorizations the need to be revoked, but only the one name-key 
binding.

I argue the RP has a right to declare the CA-issued certificate to be "null 
and void", and to be able to promote this declaration throughout the 
organization.

Perhaps this "should" be accomplished by having the RP-organization-as-CA 
issue its own certification for every public key of possible interest, in 
which case it could revoke according to the present mechanisms, and 
everything "works".  To ensure that third-party certifications are (by 
default) untrusted, it would need to purge the vendor-installed default 
root certificates from its systems.

___tony___

___tony___

Tony Bartoletti 925-422-3881 <[email-masked]>
Information Operations, Warfare and Assurance Center
Lawrence Livermore National Laboratory
Livermore, CA 94551-9900

---

From: "Housley, Russ" <[email-masked]>
Date: Thu, 31 May 2001 10:47:49 -0400

Tony:

If YourOrg decides that a particular UserNameN and UserKeyN that was 
certified by WhoeverCA, they can do so.  PKIX does not (and I think should 
not) have a standard mechanism to do so.  If YourOrg feels that one 
certificate issued by WhoeverCA should be revoked, and WhoeverCA has 
not/will not revoke it, then why would YourOrg continue to trust WhoeverCA 
for any certificates?  It seems to me that the WhoeverCA certificate should 
be revoked or removed from the certificate trust list.

Russ

At 11:43 AM 5/30/2001 -0700, Tony Bartoletti wrote:
>I argue the RP has a right to declare the CA-issued certificate to be 
>"null and void", and to be able to promote this declaration throughout the 
>organization.
>