Subject: cA Flag -- cRLSign

From: Santosh Chokhani <[email-masked]>
Date: Fri, 18 May 2001 14:55:03 -0400

Steve:

I have a compromise proposal in this area.  As Russ Housley says: In the
interest of interoperability, the generator should be strict and processor
should be forgiving (assuming no security) is compromised.

I would say let us do the following:

1.  A PKIX compliant CA must assert basicConstraints with cA set to TRUE if
cRLSign bit is set, and

2.  A PKIX compliant relying party client must check cRLSign flag in the
keyUsage extension, if keyUsage extension is present, when using the public
key of the subject to verify a signature on the CRL.  However, if the
keyUsage extension is absent, basicConstraints must be present with cA =
TRUE

Santosh Chokhani
CygnaCom Solutions, Inc.
an Entrust Technologies company
7927 Jones Branch Drive, Suite 100 West
McLean, VA 22102
[email-masked]; [email-masked]
(703) 270-3520  (703) 848-0960 (fax)

---

From: Stephen Kent <[email-masked]>
Date: Tue, 22 May 2001 08:12:54 -0400

At 2:55 PM -0400 5/18/01, Santosh Chokhani wrote:
>Steve:
>
>I have a compromise proposal in this area.  As Russ Housley says: In 
>the interest of interoperability, the generator should be strict and 
>processor should be forgiving (assuming no security) is compromised.
>
>1.  A PKIX compliant CA must assert basicConstraints with cA set to 
>TRUE if cRLSign bit is set, and
>
>2.  A PKIX compliant relying party client must check cRLSign flag in 
>the keyUsage extension, if keyUsage extension is present, when using 
>the public key of the subject to verify a signature on the CRL. 
>However, if the keyUsage extension is absent, basicConstraints must 
>be present with cA = TRUE

I think it confusing for a standard to encourage asymmetric behavior 
for CAs vs. clients. It also removes a big part of the motivation for 
CAs to set the flag according to the standard.

As I said earlier, if there is consensus to remove the need for cA to 
be asserted in certs associated with CRL validation, then we can make 
that explicit in the standard, but we just have to "buy in" to making 
the other changes to clarify this, and to name a role for entities 
who sign CRLs but who are not CAs.

Steve