Subject: RE: CA Rekey and CRL Validation

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 15 Sep 2004 13:03:11 -0400

Stefan:

That knows lies in several posting here where we have concluded that a CA =
Issuer Name and a CA != Issuer Name + Key

-----Original Message-----
From: Stefan Santesson [mailto:[email-masked]] 
Sent: Wednesday, September 15, 2004 12:56 PM
To: Santosh Chokhani; [email-masked]
Subject: RE: CA Rekey and CRL Validation

Santosh,

Thanks.

I must conclude though that the term "crystal clear" has completely
different meaning in our vocabularies :-)

All this is clear IF you understand that "complete" means not only
certificate issued under one CA key, but all certificates issued under all
keys of that CA.

But where do you gain that knowledge?
THAT is what interests me.

Stefan Santesson
Microsoft Security Center of Excellence (SCOE)

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Santosh Chokhani
> Sent: den 15 september 2004 17:24
> To: [email-masked]
> Subject: RE: CA Rekey and CRL Validation
> 
> 
> Stefan:
> 
> See Section B.5.1.1 Complete CRL and I quote it below:
> 
> "In order to determine that a CRL is a complete CRL for end-entity and 
> CA-certificates, for all reason codes of interest, the following shall
be
> true:
> -	Delta CRL indicator extension shall be absent; and
> -	Issuing distribution point extension may be present; and
> -	Issuing distribution point extension shall not contain
> distribution
> point field; and
> -	Issuing distribution point extension shall not contain
> onlyContainsUserCerts field set to TRUE; and
> -	Issuing distribution point extension shall not contain
> onlyContainsAuthorityCerts field set to TRUE; and
> -	Issuing distribution point extension shall not contain
> onlyContainsAttributeCerts field set to TRUE; and
> -	If the reasonCodes field is present in the issuing distribution
> point extension, the reasons code field shall include all the reasons
of
> interest to the application; and
> -	Issuing distribution point extension may or may not contain
> indirectCRL field (hence, this field need not be checked)."
> 
> 
> 
> -----Original Message-----
> From: Stefan Santesson [mailto:[email-masked]]
> Sent: Wednesday, September 15, 2004 11:01 AM
> To: Santosh Chokhani; [email-masked]
> Subject: RE: CA Rekey and CRL Validation
> 
> 
> Santosh,
> 
> > [Since I have been involved in crafting portions of X.509 and since
> Annex
> > B
> > that is normative makes this abundantly clear, I beg to differ that
it
> is
> > not clear enough or authors of the text did not have this in mind.
> Any
> > suggestion to make it clearer in X.509 are welcome.]
> 
> 
> Well, since I'm talking to the expert :-)
> 
> I would be very grateful if you could point me to the section in Annex
B
> that makes this "abundantly clear".
> 
> In fact, I would be even more grateful, to find the section that deals 
> with CA generation management where it is clearly stated what the 
> effect
are
> when
> re-keying a CA with a new key but the same name. E.g. that this is
still
> part of the same CA and that all language that mention the concept of
a CA
> or CRL issuer explicitly means all instances of that CA or CRL issuer
(for
> all generations of issuing keys).
> 
> All I have seen is text from which you can derive this truth. I have
NOT
> seen any text presented where this has been explicitly stated.
> 
> 
> Stefan Santesson
> Microsoft Security Center of Excellence (SCOE)
> 
> 
> 
>

---

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 15 Sep 2004 17:55:48 +0100

Santosh,

Thanks.

All this is clear IF you understand that "complete" means not only
certificate issued under one CA key, but all certificates issued under
all keys of that CA.

Stefan Santesson

be
of
it
B
> with
> CA generation management where it is clearly stated what the effect
are
still
a CA
(for
NOT