Subject: RE: Conclusions: CA Rekey and CRL Validation

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 17 Sep 2004 13:28:15 -0400

See responses in-line in [].

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Luciano (Pessoal)
Sent: Friday, September 17, 2004 10:59 AM
To: [email-masked]
Subject: Conclusions: CA Rekey and CRL Validation

After all this discursion, it is correct affirm:

1) To do a CA-Rekey it is not necessary change the CA's DN.

[MS CAPI will require that a CRL be signed using all the keys that
certificates were issued with and have not expired]

2) The "newer CA" can issue CRLs that contain revocation informations about
all the certificates issued using the new and the old key.

[It is the same CA.  It is not a different CA.  So, the term "newer CA" does
not make sense]

3) It is not necessary mantain the older CA key for issuing CRLs that
contain only revocation informations about certificates issued using the old
key (neither containing revocation info about certificates issued by the
"newer CA").

[Again, newer CA does not make sense.  If you do this, MS CAPI will not
verify the paths for older certificates]

4) A certificate issued by the "older CA" can be validated using the CRL
issued by the "newer CA", without be considered a security problem.

[Again, the terms newer and older are inappropriate]

5) For all the aspects of X509 and RFC 3280, the "newer CA" and the "older
CA" are considered the SAME CA.

Thank you,

Luciano Coelho

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Fri, 17 Sep 2004 19:52:26 +0200

Luciano (Pessoal) wrote:

>2) The "newer CA" can issue CRLs that contain revocation informations
>about all the certificates issued using the new and the old key.
>  
>
I don't like this 'can' :-)

It's ***MUST*** issue CRLs [...] about *ALL* the certificates issued 
using the new and the old key 

>contain only revocation informations about certificates issued using the
>old key (neither containing revocation info about certificates issued by
>the "newer CA").
>  
>
It's not necessary, but you may need it for applications that do not 
support verification of CRL with a key different from the key that 
signed the certificate.

In which case : The older CA key ***MUST*** issue CRLs [...] about *ALL* 
the certificates issued using the new and the old key

---

From: "Luciano (Pessoal)" <[email-masked]>
Date: Fri, 17 Sep 2004 11:59:15 -0300

5) For all the aspects of X509 and RFC 3280, the "newer CA" and the
"older CA" are considered the SAME CA.

Thank you,

Luciano Coelho

---

From: "Luciano (Pessoal)" <[email-masked]>
Date: Sat, 18 Sep 2004 17:00:52 -0300

Not considering the "feature" implemented by MS. 

    We have the chain below for the end entity certificate "EE_X".
       TA->CA1->CA2->EE_X (where TA is considered a trust anchor).

    CA2 is rekeyed and a new certificate, CA2', is generated for it with
the same DN.

    After the rekey, CA2 issues a CRL "CRL2". The certification path for
this CRL is:
       TA->CA1->CA2'->CRL2

    "CRL2" has revocation informations about all certificates issued by
"CA2" and " CA2' " certificates.

    "CRL2" doesn't have IDP extension.

    My doubts are:

1) Following the algorithm
(http://www.imc.org/ietf-pkix/mail-archive/msg03268.html) proposed by
Santosh, Can I use the CRL "CRL2" to verify the certificate "EE_X"?  If
no, why?

2) If I can do the verification above, as I suppose, Why need I  issue
CRLs using the old key (associated with CA2)?

    Thanks in advance.

    Luciano Coelho

---

From: "Santosh Chokhani" <[email-masked]>
Date: Sat, 18 Sep 2004 18:18:47 -0400

Luciano:

You can verify the CRL2.  The only reason to sign with the old key is to 
accommodate those PK enabled clients who reqire the certificate and CRL to 
be signed using the same key, e.g., MS CAPI.

On Sat, 18 Sep 2004 17:00:52 -0300, Luciano (Pessoal) wrote
>     After the rekey, CA2 issues a CRL "CRL2". The certification path 
> for this CRL is:       TA->CA1->CA2'->CRL2
> 
>     "CRL2" has revocation informations about all certificates issued 
> by "CA2" and " CA2' " certificates.
> 
> Santosh, Can I use the CRL "CRL2" to verify the certificate "EE_X"?  
> If no, why?
> 
> 2) If I can do the verification above, as I suppose, Why need I  
> issue CRLs using the old key (associated with CA2)?
> 
>     Thanks in advance.
> 
>     Luciano Coelho
>    
> Santosh Chokhani wrote:
> 
about
> >contain only revocation informations about certificates issued using the 
old

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Sun, 19 Sep 2004 00:15:35 +0200

>    Not considering the "feature" implemented by MS. 
[...]

>CRLs using the old key (associated with CA2)?
The only reason you need to issue CRL usign the old key is if you 
consider the "feature" implemented by MS, as has been described MS CAPI 
will not accept to match by name and not key if an IDP is not present.

But this kind of restriction was also implemented I think by many other 
implementers who were with reason wary of matching only by name because, 
without using the algorithm proposed by Santosh, it is dangerous.