Subject: RE: CA Rekey and CRL Validation

From: "David Cross" <[email-masked]>
Date: Mon, 13 Sep 2004 06:56:48 -0700

Santosh:

I agree that the standard is not adequate to address all scenarios and
that in many cases IDP would be useful and a secure solution to ensure
the CRL scope is complete.  Unfortunately, IDP is still not understood
by a large percentage of the deployed base and therefore not viable yet
as an ubiquitous practical solution.

Regards,

David B. Cross 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Santosh Chokhani
Sent: Monday, September 13, 2004 3:26 AM
To: [email-masked]
Subject: RE: CA Rekey and CRL Validation

David Cross:

In order to require the relying parties to match the keys also, will
require a change to the standard and will require all vendors and
implementers to remove a feature namely a CA key is not longer
available, you can re-key and continue to operate.

The secure hole in signing two CRLs for the same Issuer DN without
asserting (and hence qualifying) the CRL scope using IDP can lead the
standard compliant, secure toolkits to assume that the CRL is a full and
complete CRL for the CA.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of David Cross
Sent: Sunday, September 12, 2004 11:06 PM
To: Santosh Chokhani; [email-masked]
Subject: RE: CA Rekey and CRL Validation

Santosh:

I completely disagree and I know you and I have disagreed on this in the
past. If a CA has two signing certs with different keys that are each
used to respectfully sign a CRL, it would be considered insecure for a
relying party to match on name alone without making a cryptographic key
match as well.  Client software that matches on name alone with no key
validation is INSECURE, standards compliant or not. I do, however, agree
that having unique CRL DP is very desireable to avoid ambiguity in CRL
discovery by relying parties.

Regards,
 
David B. Cross

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Santosh Chokhani
Sent: Sunday, September 12, 2004 5:34 PM
To: [email-masked]
Subject: RE: CA Rekey and CRL Validation

And that is INSECURE unless both CRLs cover all the certificates issued
by the CA or the certificates and CRLs are properly qualified with CRL
DP and IDP respectively.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 13 Sep 2004 10:22:11 -0400

David Cross:

If you think applications will not understand IDP, the appropriate, secure,
and standard compliant way to do this is as follows:

Issue multiple CRLs covering all certiifcates (regardless of the key used to
sign them) issued by the same DN.  None of these CRLs need to (neither they
should) assert IDP.

Optionally, if you want to reduce CRL size, each set of certificates and
CRLs can have the appropriate CRL DP and IDP respectively.

-----Original Message-----
From: David Cross [mailto:[email-masked]] 
Sent: Monday, September 13, 2004 9:57 AM
To: Santosh Chokhani; [email-masked]
Subject: RE: CA Rekey and CRL Validation

Santosh:

I agree that the standard is not adequate to address all scenarios and that
in many cases IDP would be useful and a secure solution to ensure the CRL
scope is complete.  Unfortunately, IDP is still not understood by a large
percentage of the deployed base and therefore not viable yet as an
ubiquitous practical solution.

Regards,

David B. Cross 

-----Original Message-----

David Cross:

In order to require the relying parties to match the keys also, will require
a change to the standard and will require all vendors and implementers to
remove a feature namely a CA key is not longer available, you can re-key and
continue to operate.

The secure hole in signing two CRLs for the same Issuer DN without asserting
(and hence qualifying) the CRL scope using IDP can lead the standard
compliant, secure toolkits to assume that the CRL is a full and complete CRL
for the CA.

-----Original Message-----

Santosh:

I completely disagree and I know you and I have disagreed on this in the
past. If a CA has two signing certs with different keys that are each used
to respectfully sign a CRL, it would be considered insecure for a relying
party to match on name alone without making a cryptographic key match as
well.  Client software that matches on name alone with no key validation is
INSECURE, standards compliant or not. I do, however, agree that having
unique CRL DP is very desireable to avoid ambiguity in CRL discovery by
relying parties.

Regards,
 
David B. Cross

-----Original Message-----

And that is INSECURE unless both CRLs cover all the certificates issued by
the CA or the certificates and CRLs are properly qualified with CRL DP and
IDP respectively.

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Tue, 14 Sep 2004 11:36:41 +0200

>and standard compliant way to do this is as follows:
IDP is a critical extension. Application can be unable to understand it, 
but are very strongly broken if they ignore it ...

>sign them) issued by the same DN.  None of these CRLs need to (neither they
As the standard says that a CA is defined by it's name, isn't this 
naturally the one and only correct thing to do ?

If it *is* the same CA, then it *has* to both respect the serial number 
uniqueness and to continue to cover all certificate it issued that are 
still in their validity period ...

---

From: "Santosh Chokhani" <[email-masked]>
Date: Tue, 14 Sep 2004 07:58:00 -0400

Jean-Marc:

I read your posting as supporting my position.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Jean-Marc Desperrier
Sent: Tuesday, September 14, 2004 5:37 AM
To: [email-masked]
Subject: Re: CA Rekey and CRL Validation

Santosh Chokhani wrote:

>If you think applications will not understand IDP, the appropriate, 
>secure, and standard compliant way to do this is as follows:
>  
>

>Issue multiple CRLs covering all certiifcates (regardless of the key 
>used to sign them) issued by the same DN.  None of these CRLs need to 
>(neither they
>should) assert IDP.
>  
>