Subject: AW: CA Rekey and CRL Validation

From: [email-masked]
Date: Fri, 17 Sep 2004 09:47:47 +0200

Hi all,

there is an other point I am wondering about: For what purpose do I need
indierkt CRLs within the PEM valitity model (i. e. the validity of an
entities certificate lies between the notBefore an notAfter limits of the
issuing CAs certificate)?

Thomas

> -----Ursprüngliche Nachricht-----
> Von: Denis Pinkas [mailto:[email-masked]]
> Gesendet: Freitag, 17. September 2004 09:10
> An: Santosh Chokhani
> Cc: [email-masked]
> Betreff: Re: CA Rekey and CRL Validation
> 
> 
> 
> Santosh,
> 
> > Denis:
> 
> > In X.509, a CA when it issues a CRL is called CRL issuer.  
> Please look at
> > the text of all the extensions descriptions related to CRL issuance.
> 
> > Thus, saying a CA is not a CRL Issuer is incorrect in general.
> 
> I did not say this.
> 
> > In addition, if we assumed your interpretation that a CRL 
> Issuer does not
> > issue any certificates, the following sentence which began 
> this debate will
> > be meaning less.
> > 
> > "If this field is absent, the CRL shall contain entries for 
> all revoked
> > unexpired certificates issued by the CRL issuer."
> 
> This sentence is not present in RFC 3280.
> 
> On page 59, we have the following sentence:
> 
>     If the distributionPoint field is absent, the CRL MUST contain
>     entries for all revoked unexpired certificates *issued* by the CRL
>     issuer, if any, within the scope of the CRL
> 
> This sentence is either ambiguous or incorrect: a CRL issuer does not 
> *issue* certificates. On page 7, the definition of a CRL issuer is:
> CRL issuer: an optional system to which a CA delegates the 
> publication of 
> certificate revocation lists.
> 
> Besides this "battle" around words, since I have not followed all the 
> messages of this thread, a summary would be interresting to 
> answer the two 
> following questions:
> 
> 1) under which circumstances would the distributionPoint 
> field within the 
> issuing distribution point structure really useful for ?
> 
> 2) what kind of processing should a relying party make of it, 
> when this 
> field is present ?
> 
> Denis
> 
> > -----Original Message-----
> > From: [email-masked] 
> [mailto:[email-masked]] On
> > Behalf Of Denis Pinkas
> > Sent: Thursday, September 16, 2004 12:03 PM
> > To: Carl Wallace
> > Cc: [email-masked]
> > Subject: Re: CA Rekey and CRL Validation
> > 
> > 
> > 
> > Carl,
> > 
> > 
> >>>>(including certificates issued by the CRL issuer).
> >>>
> >>>This is incorrect: a CRL issuer cannot issue certificates.
> >>>
> >>
> > 
> >>Why is that?  Given the limited use of the indirectCRL 
> mechanism, most 
> >>CRL issuers issue certificates.
> > 
> > 
> > A CRL issuer only issues CRLs.
> > A CA issues certificates and may also issue CRLs and/or 
> OCSP responses.
> > 
> > Denis
> > 
> > 
> > 
> > 
> 
>

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 17 Sep 2004 08:40:38 -0400

Thomas:

There may be several usage of indirect CRL such as:

1. It may be used for assigning a superior authority to issue revocation
status of a self-issued certificate.  

2.  It may be used by one, many or all CAs in an enterprise to point to an
authority that consolidates and publishes highly security critical
revocations frequently.  Examples of highly security critical revocations
are CA compromise and key compromise.  The approach has benefits of getting
a small CRL (hopefully highly security critical compromises are few) that
can be issued frequently and covers all certificates in an Enterprise
certification path.  Frequent issues reduces the CRL suppression and replay
attacks.

The above are two examples of the usage.  There may be many others.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of [email-masked]
Sent: Friday, September 17, 2004 3:48 AM
To: [email-masked]
Subject: AW: CA Rekey and CRL Validation

Hi all,

Thomas