Subject: RE: CA Rekey and CRL Validation

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 15 Sep 2004 16:01:13 +0100

Santosh,

> [Since I have been involved in crafting portions of X.509 and since
Annex
> B
> that is normative makes this abundantly clear, I beg to differ that it
is
> not clear enough or authors of the text did not have this in mind.
Any
> suggestion to make it clearer in X.509 are welcome.]

Well, since I'm talking to the expert :-)

I would be very grateful if you could point me to the section in Annex B
that makes this "abundantly clear".

In fact, I would be even more grateful, to find the section that deals
with CA generation management where it is clearly stated what the effect
are when re-keying a CA with a new key but the same name. E.g. that this
is still part of the same CA and that all language that mention the
concept of a CA or CRL issuer explicitly means all instances of that CA
or CRL issuer (for all generations of issuing keys).

All I have seen is text from which you can derive this truth. I have NOT
seen any text presented where this has been explicitly stated.

Stefan Santesson
Microsoft Security Center of Excellence (SCOE)

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 15 Sep 2004 11:23:57 -0400

Stefan:

See Section B.5.1.1 Complete CRL and I quote it below:

"In order to determine that a CRL is a complete CRL for end-entity and
CA-certificates, for all reason codes of interest, the following shall be
true:
-	Delta CRL indicator extension shall be absent; and
-	Issuing distribution point extension may be present; and
-	Issuing distribution point extension shall not contain distribution
point field; and
-	Issuing distribution point extension shall not contain
onlyContainsUserCerts field set to TRUE; and
-	Issuing distribution point extension shall not contain
onlyContainsAuthorityCerts field set to TRUE; and
-	Issuing distribution point extension shall not contain
onlyContainsAttributeCerts field set to TRUE; and
-	If the reasonCodes field is present in the issuing distribution
point extension, the reasons code field shall include all the reasons of
interest to the application; and
-	Issuing distribution point extension may or may not contain
indirectCRL field (hence, this field need not be checked)."

-----Original Message-----
From: Stefan Santesson [mailto:[email-masked]] 
Sent: Wednesday, September 15, 2004 11:01 AM
To: Santosh Chokhani; [email-masked]
Subject: RE: CA Rekey and CRL Validation

Santosh,

Annex
is
Any

In fact, I would be even more grateful, to find the section that deals with
CA generation management where it is clearly stated what the effect are when
re-keying a CA with a new key but the same name. E.g. that this is still
part of the same CA and that all language that mention the concept of a CA
or CRL issuer explicitly means all instances of that CA or CRL issuer (for
all generations of issuing keys).

Stefan Santesson