Subject: Re: RE: RE: Re: Correction to be done to <draft-pinkas-pkix-conf-crl-validation-01.txt>

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 26 Jul 2005 16:11:46 +0100

>Denis,

>Make it simple?

>In your simple case the CRL would not contain the name of the
>certificate issuer anywhere!

Yes, but this is NOT needed from a security point of view.

>Disregarding any increased security vulnerability due to decreased name
>matching between cert and CRL, it would require change to existing code
>to handle this new special case, introducing detection and special
>handling of "delegated CRL".

If you take a look at my I-D, what you call "existing code" is still being supported.

My proposal is to add a (more simple) piece of code that would avoid implementers to 
implement the existing algorithm that is more complex, since it is applicable when 
many non-mandatory-to-support extensions are present.

Denis

>That is NOT called making things simple. That is creating problems.

>
>Stefan Santesson
>Program Manager, Standards Liaison
>Windows Security

---

From: "Santosh Chokhani" <[email-masked]>
Date: Tue, 26 Jul 2005 12:05:08 -0400

Denis,

Delegated single CRL issuer is a new mechanism and can not fit the current
X.509 or 3280.

You are welcome to help build new extensions if PKIX and X.509 groups are
interested in.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Denis Pinkas
Sent: Tuesday, July 26, 2005 11:12 AM
To: Stefan Santesson; Sharon Boeyen; David A. Cooper; Santosh Chokhani
Cc: pkix
Subject: Re: RE: RE: Re: Correction to be done to
<draft-pinkas-pkix-conf-crl-validation-01.txt>

>handling of "delegated CRL".

If you take a look at my I-D, what you call "existing code" is still being
supported.

My proposal is to add a (more simple) piece of code that would avoid
implementers to 
implement the existing algorithm that is more complex, since it is
applicable when 
many non-mandatory-to-support extensions are present.

Denis