Subject: RE: New-PKIX-Part1 conflict with X.509 (2000)

From: Santosh Chokhani <[email-masked]>
Date: Tue, 5 Feb 2002 10:38:12 -0500

I agree with Rich on this one.

I think if the CRL DP does not have DP field, the IDP in the CRL should not
have one either.

That seems that safest thing to do.

Once a DP field is present a CRL IDP extension, there is no way for a client
to determine whether a CRL is complete for its scope.

-----Original Message-----
From: Nicholas, Richard [mailto:[email-masked]]
Sent: Monday, February 04, 2002 3:54 PM
To: 'David A. Cooper'; [email-masked]'
Subject: RE: New-PKIX-Part1 conflict with X.509 (2000)

Dave,

See my comments below.

> The important question is not whether a CRL is complete, but 
> whether it covers the certificate of interest. On this issue, 
> I believe that PKIX and X.509 are in agreement.
> 
> The text in section 6.3.3 does not say anything about whether 
> a CRL is complete. It merely says that a CRL containing a 
> distribution point field in an IDP CRL extension covers a 
> certificate if the DP name matches the certificate issuer's name.
> 
> In X.509, section B.5.1 provides rules for determining 
> whether a certificate is covered by a CRL. If a CRL meets the 
> criteria in section B.5.1.1 (Complete CRL) then it is a 
> complete CRL and thus covers all certificates issued by the 
> CRL issuer.
> 
> If the CRL contains an IDP extension with a distribution 
> point name, then section B.5.1.4 (Distribution point based 
> CRL/EPRL/CARL) applies. This section states that if the 
> distribution point name in the IDP extension is present, it 
> must match one of the names in the distribution point or CRL 
> issuer field in the CRL DP in the certificate.
> 
> Section 8.6.2.1 in X.509 states that if the distribution 
> point name is absent from the CRL DP extension then "the 
> distribution point name defaults to the CRL issuer name". 
> Thus, under the scenario that you mentioned, an algorithm 
> that follows X.509 will accept the CRL as covering the certificate.
> 
> Dave

The text you quoted from section 8.6.2.1 in X.509 is not meant to imply that
all certs have distribution points, only to specify what name to use when
the optional distributionPoint component is absent.

In the cases where either:
1.  the CRL distribution points extension is absent, or
2.  the CRL distribution points have been processed, but not all revocation
reasons have been checked,
the software will then attempt to acquire and validate a complete CRL that
covers the remaining reason codes for the type of cert (CA or EE).

In those cases, the software follows the X.509 rules specified for complete
CRLs, since that is the type of CRL it requires -- not a distribution point
CRL.  The presence of an IDP extension in a CRL does not make the CRL a DP
CRL -- even complete CRLs can contain IDP extensions.

- Rich

---

From: "David A. Cooper" <[email-masked]>
Date: Tue, 05 Feb 2002 12:19:48 -0500

At 10:38 AM 2/5/02 -0500, Santosh Chokhani wrote:

>I think if the CRL DP does not have DP field, the IDP in the CRL should not have one either. 
>
>Once a DP field is present a CRL IDP extension, there is no way for a client to determine whether a CRL is complete for its scope.

Santosh,

X.509 states the following about the CRL DP extension:

         The distributionPoint component identifies the location from which the CRL can be obtained.
         If this component is absent, the distribution point name defaults to the CRL issuer name.

Thus, it is possible for a CRL that contains a distribution point name in the IDP extension to match a certificate with a CRL DP that does not have a DP field. This can happen in one of two ways: either (1) the cRLIssuer field is absent from the CRL DP and the certificate issuer = CRL issuer = DP name in IDP, or (2) the cRLIssuer field is present and the cRLIssuer in the CRL DP = CRL issuer = DP name in IDP.

Unlike PKIX, X.509 seems to allow for a DistributionPoint in a CRL DP extension to be empty (i.e., all three optional elements absent). In this case, the cRLIssuer defaults to the certificate issuer name and the distributionPoint defaults to the certificate issuer name as well. A CRL covering this certificate may have an IDP extension with a DP as long as one the DPs in the extension is the certificate issuer's name. Given this, it seems logical that certificate with no CRL DP extension would also be covered by that CRL. PKIX, in section 6.3.3 explicitly states this:

         For the processing of [a CRL that is not pointed to by a CRL DP], assume a DP
         with both the reasons and the cRLIssuer fields omitted and a distribution point
         name of the certificate issuer.

Is this wrong? If so, why?

On a related note, there does seem to be a problem with the text in X.509. At the end of section 8.6.2.1, it states:

         If [the CRL DP] extension is flagged non-critical and a certificate-using system does
         not recognize the extension field type, then that system should only use the certificate if:

         - it can acquire and check a complete CRL from the authority (that the latter CRL is complete
           is indicated by the absence of an issuing distribution point extension field in the CRL);

It is not necessary, however, to use a complete CRL. If one is checking the status of an end entity certificate, for example, the CRL could have an IDP extension with onlyContainsUserCerts asserted. One does not need to be able to process the CRL DP extension to determine that the certificate is covered by this CRL. Similarly, the IDP extension in the CRL could have an onlySomeReasons flag.

Dave