Subject: Re: I-D ACTION:draft-ietf-pkix-certstore-http-01.txt

From: [email-masked] (Peter Gutmann)
Date: Wed, 9 Jan 2002 18:08:12 +1300 (NZDT)

Michael StrM-vder <[email-masked]> writes:

>While I understand the rationale in section 3.4 that AIA and CRLDP extensions
>are different in semantics I think the CRL could be retrieved via
>CRLDistributionPoint as long as the HTTP certificate store interface behaves
>as expected for CRLDistributionPoint. 

But it doesn't behave that way.  As the rationale points out, CRLDP points at a
static CRL while the draft uses a general CRL query mechanism.  To put it
another way, let's say you get a cert with a CRLDP containing a URI:

  foo.bar.com/qwertyuiop

What are you supposed to do with this?  If you follow CRLDP semantics, you go
to foo.bar.com and do a GET /qwertyuiop HTTP/1.0.  If you follow the draft
semantics you go to foo.bar.com and do a GET /qwertyuiop/search-cgi?iHash=
<search key> HTTP/1.0 (or whatever key you're using).  Unless you completely
redefine the semantics of CRLDP to constrain it to follow the functionality in
the draft, you can't do this.

>But I don't understand this sentence in section 3.4: "In addition CRLDP
>associates other attribute information with a query which is incompatible with
>the simple query mechanisms presented in this document."

You can specify all sorts of stuff like reason flags which can't be accomodated
by a key-and-value lookup mechanism.

Peter.

---

From: Michael Ströder <[email-masked]>
Date: Wed, 09 Jan 2002 17:05:10 +0100

> the draft, you can't do this.

I still can't see the difference. Even (outdated) RFC 1738
referenced in RFC 2459 allows a query string being part of an URI.
While glancing over RFC 2459 and draft-ietf-pkix-new-part1-11 I
could not find a hint which prevents me from using a query string in
CRLDistributionPoint.distributionPoint.fullName. Therefore I can use

GET /qwertyuiop/search-cgi?iHash=<search key>

with <search key> being a constant uniquely identifying the CRL.

BTW: The "static" URI form

foo.bar.com/qwertyuiop

doesn't mean that the web server serves a static file. Could be also
a web application acting different for path info /qwertyuiop and
/poiuytrewq.

Ciao, Michael.