Subject: RE: CA Rekey and CRL Validation

From: "David Cross" <[email-masked]>
Date: Sun, 12 Sep 2004 20:06:04 -0700

Santosh:

I completely disagree and I know you and I have disagreed on this in the
past. If a CA has two signing certs with different keys that are each
used to respectfully sign a CRL, it would be considered insecure for a
relying party to match on name alone without making a cryptographic key
match as well.  Client software that matches on name alone with no key
validation is INSECURE, standards compliant or not. I do, however, agree
that having unique CRL DP is very desireable to avoid ambiguity in CRL
discovery by relying parties.

Regards,
 
David B. Cross

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Santosh Chokhani
Sent: Sunday, September 12, 2004 5:34 PM
To: [email-masked]
Subject: RE: CA Rekey and CRL Validation

And that is INSECURE unless both CRLs cover all the certificates issued
by the CA or the certificates and CRLs are properly qualified with CRL
DP and IDP respectively.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Joel S. Kazin
Sent: Sunday, September 12, 2004 6:54 PM
To: Santosh Chokhani; [email-masked]
Subject: RE: CA Rekey and CRL Validation

Provided you have nested your certificate lifetimes properly, the
last/longest lived certificate issued by the CA using the old signing
key will reach its notAfter date before the signers key expires, you can
have more than one CRLs being concurrently issued by the same CA.
Specifically, when re-keying, a Windows 2003 CAs that is not the root CA
it will continue to issue CRLs and delta CRLs for the old key which has
stopped signing certificates.  The new private key will sign
certificates, CRLs, and delta CRLs.  Yes, the signers DN does not change
only the signers certificate and keys. We have one client who has been
pushing out two CRLs and two delta CRLs for over 7 months, alI signed by
the same CA but with two different keys. They have at least 30,000
certificates outstanding.  By the way the Microsoft 2003 CA will not
issue a certificate where the signers notAfter date is less than that of
that of the certificate it signs. In other words if your CA's signing
certificate expires in 6 months but you as for an end-entity certificate
expiring in two years you get an end entity certificate that expires in
6 months.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 13 Sep 2004 06:25:33 -0400

David Cross:

In order to require the relying parties to match the keys also, will require
a change to the standard and will require all vendors and implementers to
remove a feature namely a CA key is not longer available, you can re-key and
continue to operate.

The secure hole in signing two CRLs for the same Issuer DN without asserting
(and hence qualifying) the CRL scope using IDP can lead the standard
compliant, secure toolkits to assume that the CRL is a full and complete CRL
for the CA.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of David Cross
Sent: Sunday, September 12, 2004 11:06 PM
To: Santosh Chokhani; [email-masked]
Subject: RE: CA Rekey and CRL Validation

Santosh:

I completely disagree and I know you and I have disagreed on this in the
past. If a CA has two signing certs with different keys that are each used
to respectfully sign a CRL, it would be considered insecure for a relying
party to match on name alone without making a cryptographic key match as
well.  Client software that matches on name alone with no key validation is
INSECURE, standards compliant or not. I do, however, agree that having
unique CRL DP is very desireable to avoid ambiguity in CRL discovery by
relying parties.

Regards,
 
David B. Cross

-----Original Message-----

And that is INSECURE unless both CRLs cover all the certificates issued by
the CA or the certificates and CRLs are properly qualified with CRL DP and
IDP respectively.

-----Original Message-----

Provided you have nested your certificate lifetimes properly, the
last/longest lived certificate issued by the CA using the old signing key
will reach its notAfter date before the signers key expires, you can have
more than one CRLs being concurrently issued by the same CA. Specifically,
when re-keying, a Windows 2003 CAs that is not the root CA it will continue
to issue CRLs and delta CRLs for the old key which has stopped signing
certificates.  The new private key will sign certificates, CRLs, and delta
CRLs.  Yes, the signers DN does not change only the signers certificate and
keys. We have one client who has been pushing out two CRLs and two delta
CRLs for over 7 months, alI signed by the same CA but with two different
keys. They have at least 30,000 certificates outstanding.  By the way the
Microsoft 2003 CA will not issue a certificate where the signers notAfter
date is less than that of that of the certificate it signs. In other words
if your CA's signing certificate expires in 6 months but you as for an
end-entity certificate expiring in two years you get an end entity
certificate that expires in 6 months.