Subject: RE: CA Rekey and CRL Validation

From: Sharon Boeyen <[email-masked]>
Date: Wed, 15 Sep 2004 10:00:27 -0400

Santosh I'm not sure what you are asking for comment on.

However, I do not want to see a change made that would invalidate currently
conformant implmentations that behave along the following lines:

- CA key rollover is handled with self-issued certificates (new key signed
with old and old key signed with new). Where this involves a full and
complete CRL for the CA, and there is no IDP present in the CRL, then the
CRL continues to list all revoked and unexpired certificates issued by that
CA, regardless of the key that had been originally used to sign the
certificate. 

Also I would not support any change that invalidated use of that same
technique (self issued certs) along with the use of CRLDP and IDP to handle
partitioned CRL environments. In this case again the partitioned CRLs can
continue to list all revoked unexpired certificates that point to that CRL
in their CRLDP regardless of the key that was used to sign that certificate
(either the old or new key). 

Yes there are implementations that behave this way if that is what you are
asking.

Cheers,
Sharon 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Santosh Chokhani
Sent: Wednesday, September 15, 2004 9:11 AM
To: [email-masked]
Subject: RE: CA Rekey and CRL Validation

Stefan:

I am not saying IDP only limits scope.  I am saying the only way to limit
scope (Since 3280 does not use CRL Scope extension) is to use IDP.  IDP
absent means (delta not withstanding) the CRL is complete for the Issuer,
and does not contain any revocation information about certificates issued by
other CAs and hence must not contain Certificate Issuer extension in any of
the CRL entries.

(BTW, when an IDP is asserted in a CRL, it does not mean the CRL is not
complete.  It is that relying party does not know whether it is complete or
not.  I would encourage you to read X.509 Annex B for further details.)

I would let the vendors respond if they do key rollover right.

-----Original Message-----
From: Stefan Santesson [mailto:[email-masked]] 
Sent: Wednesday, September 15, 2004 8:17 AM
To: Carl Wallace; Santosh Chokhani; [email-masked]
Subject: RE: CA Rekey and CRL Validation

Carl,

Thanks for some good technical arguments.

Your arguments of the scope if CRLs without IDP makes sense in the reading
of a CRL issuer as all instances of a CA (representing all issuing keys).

I must say though that this isn't very clearly stated in the standards
documents and hence it is easily misunderstood by implementers. 

So I don't disagree, but I wander if there is any CA implementation doing
re-keying that has got that "right". Probably a reason why the practice
described by Laudon is the only thing that really works in open
environments.

I do however disagree that IDP only limit scope. IDP may e.g. have an
indirectCRL indicator which is a clear expansion of scope for the CRL.

Stefan Santesson
Microsoft Security Center of Excellence (SCOE)

> -----Original Message-----
> From: Carl Wallace [mailto:[email-masked]]
> Sent: den 15 september 2004 13:28
> To: Stefan Santesson; 'Santosh Chokhani'; [email-masked]
> Subject: RE: CA Rekey and CRL Validation
> 
> Inline...
> 
> > -----Original Message-----
> > From: [email-masked]
> > [mailto:[email-masked]] On Behalf Of Stefan Santesson
> > Sent: Wednesday, September 15, 2004 5:22 AM
> > To: Santosh Chokhani; [email-masked]
> > Subject: RE: CA Rekey and CRL Validation
> >
> > Santosh,
> >
> > You miss my point.
> >
> > I was expressing this generally but of course, in practice we only
> > discuss the case where a CA is re-keyed without changing its name.
> >
> > The security vulnerability is then exposed if those 2 CA's keep
> > issuing CRL's without IDP with scope limited to their respective 
> > issued certificates.
> 
> IDP is the means of limiting scope.  From 3280, "the issuing
distribution
> point is a critical CRL extension that identifies the CRL distribution
> point and scope for a particular CRL."  If IDP is missing, how are the 
> CAs limiting scope?  Who is aware of this scope limitation?
> 
> > You showed this yourself in one of your examples before!
> >
> > I'm not aware of any section in RFC 3280 or X.509 that declare this
> > practice invalid.
> 
> The following text from section 5.2.5 of 3280 declares this practice
> invalid: "if the distributionPoint field is absent, the CRL MUST
contain
> entries for all revoked unexpired certificates issued by the CRL
issuer,
> if
> any, within the scope of the CRL."  If an IDP is missing, so too is
the
> distributionPoint field.  Thus, "the CRL MUST contain entries for all
> revoked, unexpired certificates issued by the CRL issuer".  An
instance
> where a CA issues CRLs that covers only certificates issued using a
> particular key but does not include an IDP is broken.  The 3280 text
is
> broken too because the CRL issuer need not be the issuer of the
> certificates just because there is no distributionPoint field.
> 
> > The RP software that doesn't enforce key match in this instance may
> > now validate a certificate using the wrong CRL and come to the wrong 
> > conclusion.
> 
> While this is true, the problem begins with the CA limiting scope by
means
> other than IDP.
> 
> > If a CA and an RP deploys standards compliant configurations and the
> > RP end up accepting a revoked certificate, this is a vulnerability.
> >
> > Now, another FACT is that if validation of CRL without IDP requires
> > key match, then that would solve this vulnerability.
> 
> The fact is that without an IDP the CRL must be complete for all
> certificates issued by the CRL issuer.  This leads back to the name 
> problem that is addressed elsewhere in this thread.
> 
> > Do we want to fix this problem in this way? That is another question
> > open for debate...
> 
> I'd vote no to fixing this with key match.  If you want key match, use
a
> different IDP for each key.
> 
> > Stefan Santesson
> > Microsoft Security Center of Excellence (SCOE)
> >

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 15 Sep 2004 11:00:41 -0400

Sharon:

Please see responses in-line in [].

-----Original Message-----
From: Sharon Boeyen [mailto:[email-masked]] 
Sent: Wednesday, September 15, 2004 10:00 AM
To: 'Santosh Chokhani'; [email-masked]
Subject: RE: CA Rekey and CRL Validation

[I am not asking to comment on anything.]

[You have to be careful in using self-issued certificates approach.  There
is no simple way to promulgate their revocation status unless both keys are
used to issue two CRLs]

Cheers,
Sharon 

-----Original Message-----

Stefan:

-----Original Message-----
From: Stefan Santesson [mailto:[email-masked]] 
Sent: Wednesday, September 15, 2004 8:17 AM
To: Carl Wallace; Santosh Chokhani; [email-masked]
Subject: RE: CA Rekey and CRL Validation

Carl,

Stefan Santesson

distribution
contain
issuer,
the
instance
is
means
a