Subject: Freshest CRL

From: "Stefan Santesson" <[email-masked]>
Date: Mon, 29 Mar 2004 23:05:34 +0100

Is Freshest CRL supposed to be a Certificate extension or a CRL
extension?

I have always believed that it was a CRL extension, as defined in RFC
3280 section 5.2.6:

5.2.6  Freshest CRL (a.k.a. Delta CRL Distribution Point)

   The freshest CRL extension identifies how delta CRL information for
this complete CRL is obtained.

However,

In X.509, this extension is defined a s a certificate extension only in
section 8.6.2.6

8.6.2.6     Freshest CRL extension

The freshest CRL extension shall be used only as a certificate extension
and may be used in certificates issued to authorities as well as
certificates issued to users. This field identifies the CRL to which a
certificate user should refer to obtain the freshest revocation
information (e.g.: latest dCRL). This field is defined as follows:

Which is correct?

Stefan Santesson

Program Manager, Windows Security

---

From: "Shim Heewon" <[email-masked]>
Date: Tue, 30 Mar 2004 10:52:27 +0900

Of course, both of them are needed Freshest CRL. (Cert and CRL extension)

1.       Using Freshest CRL extension on Certificate, you can find exact URI
to get exact CRL.

2.       Using Freshest CRL extension on CRL (matching on Cert), you can
determine whether this CRL is the correct one among other delta CRLs or not.

Because of replace attack of CRL, you should use this extension on both of
them.

This case is very similar to the case of CRL Distribution Point (on Cert)
and Issuing Distribution Point (on CRL).

  _____  

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Stefan Santesson
Sent: Tuesday, March 30, 2004 7:06 AM
To: [email-masked]
Subject: Freshest CRL

Is Freshest CRL supposed to be a Certificate extension or a CRL extension?

I have always believed that it was a CRL extension, as defined in RFC 3280
section 5.2.6:

   The freshest CRL extension identifies how delta CRL information for this
complete CRL is obtained.

However,

The freshest CRL extension shall be used only as a certificate extension and
may be used in certificates issued to authorities as well as certificates
issued to users. This field identifies the CRL to which a certificate user
should refer to obtain the freshest revocation information (e.g.: latest
dCRL). This field is defined as follows:

Which is correct?

Stefan Santesson

---

From: "David A. Cooper" <[email-masked]>
Date: Wed, 31 Mar 2004 10:08:14 -0500

Shim Heewon wrote:

> 1.       Using Freshest CRL extension on Certificate, you can find 
> exact URI to get exact CRL.
>
> 2.       Using Freshest CRL extension on CRL (matching on Cert), you 
> can determine whether this CRL is the correct one among other delta 
> CRLs or not.
>
>  
>
> Because of replace attack of CRL, you should use this extension on 
> both of them.
>
> This case is very similar to the case of CRL Distribution Point (on 
> Cert) and Issuing Distribution Point (on CRL).
>
Actually, the FreshestCRL extension works the same way as the 
cRLDistrubutionPoints extension.  That is, when the FreshestCRL 
extension appears in a certificate the CRL must have a matching 
issuingDistributionPoint, where the matching is done in the same way as 
if a cRLDistrubutionPoints were being used in the certificate.  RFC 3280 
states that the FreshestCRL extension should only be used to point to 
delta-CRLs, but X.509 does not impose this restriction.  X.509 allows 
the FreshestCRL extension to be used in any way that the 
cRLDistrubutionPoints can be used.

The use of a FreshestCRL extension in a CRL is more tricky, since this 
would seem to involve comparing the FreshestCRL extension in one CRL to 
the issuingDistributionPoint extension in another CRL (presumably a 
corresponding delta-CRL).  The RFC 3280 simplifies this by stating that 
when the FreshestCRL extension appears in a CRL, it should only contain 
the distribution point name, which acts as a pointer to a delta-CRL.  
RFC 3280 further requires that the delta-CRL contain the same 
issuingDistributionPoint field as the corresponding complete for scope 
CRL.  This allows for the FreshestCRL extension in the CRL to only act 
as a pointer since the issuingDistribuionPoint extension in the 
delta-CRL can be compared to the cRLDistributionPoint extension in the 
certificate.

Dave