Subject: RE: CA Rekey and CRL Validation

From: Stephen Kent <[email-masked]>
Date: Tue, 14 Sep 2004 15:37:28 -0400

At 8:13 PM +0100 9/14/04, Stefan Santesson wrote:
>I think this requires for some kind of response.
>
>>  And anyway, the solution Microsoft employees favor is to use IDP
>>  everytime the CRL is not signed with the same key as the CA.
>
>Participation on this list is done by individuals contributing to
>development of good public standards.
>
>In doing so some of us share open facts and experiences from the
>products we work with.
>That is NOT intended as a public declaration of best practices.
>
>And your conclusion is wrong. What I ask this group to consider is
>whether validation of a CRL without IDP should require both name AND key
>match.

Stefan,

I respect your ability to maintain the employer/individual 
perspective that you stated. Your comments have shown this to be the 
case over time.

So, yes, the issue before us is whether we need to change the 
criteria for CRL validation, as noted. I think we are still debating 
this issue.

Steve

---

From: "David P. Kemp" <[email-masked]>
Date: Tue, 14 Sep 2004 17:21:13 -0400

Validation of a CRL without IDP should require only a name match, using 
fully-qualified
names to a common trust anchor as described by Santosh's algorithm.

DNS works properly in the face of hostname and name component duplications.
The requirement to compare only FQDNs is so obvious as to not even require
discussion.   It would be nice if every CA in the universe partcipated 
in the
global Directory Information Tree and every DN uniquely identified a node
in that tree.  But since actual CAs practice only local naming consistency,
a full certification name path is necessary and sufficient.  Key matching is
not necessary.

----------

On a totally separate issue, I agree with Laudon Williams that changing CA
names when rekeying is a useful practice to work around application 
limitations,
just as having a single certifying organization operate hundreds or 
thousands
of CA names/keys is useful to allow CRL partitioning in the face of 
applications
that don't grok IDP.  Standards-compliant applications would be better,
but "making things work" with non-compliant apps is OK as long as CAs
don't become non-compliant as a result.

Dave

Stephen Kent wrote:

>> ... What I ask this group to consider is
> ...
> So, yes, the issue before us is whether we need to change the criteria 
> for CRL validation, as noted. I think we are still debating this issue.