Subject: RE: IDP indirectCRL flag

From: "Manger, James H" <[email-masked]>
Date: Mon, 25 Jul 2005 11:43:02 +1000

Denis,

Perhaps your rules could work if a CRL issuer is not itself a CA and it only handles certificates from a single CA.  However, a relying party cannot know (and must not assume) that this is the case for the CRL issuer.

A certificate with a CRL-DP.cRLIssuer field tells the RP that the named CRL issuer handles certificates from at least the issuer of this certificate.  It gives no information about how many other CAs (if any) the CRL issuer may also handle, nor whether the CRL issuer is also a CA itself.  A CRL-DP.cRLIssuer field tells the RP that some CRLs from the named CRL issuer should cover this certificate, but it does not tell the RP that all CRLs do.

P.S. A CRL issuer may as well use the same name as the CA if it is only ever going to issue revocation info for that CA's certificates.  That is, the CA delegates CRL issuance to a separate key, not to a separate name.  This avoids CRL-DP.cRLIssuer, IDP.indirectCRL & CRL-ENTRY.certificateIssuer fields completely.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 25 Jul 2005 08:08:39 -0400

James Manger and Denis,

Can you explain me why we would want to change the standard and impose these
additional constraints for indirect CRL?

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Manger, James H
Sent: Sunday, July 24, 2005 9:43 PM
To: pkix
Subject: RE: IDP indirectCRL flag

Denis,

Perhaps your rules could work if a CRL issuer is not itself a CA and it only
handles certificates from a single CA.  However, a relying party cannot know
(and must not assume) that this is the case for the CRL issuer.

A certificate with a CRL-DP.cRLIssuer field tells the RP that the named CRL
issuer handles certificates from at least the issuer of this certificate.
It gives no information about how many other CAs (if any) the CRL issuer may
also handle, nor whether the CRL issuer is also a CA itself.  A
CRL-DP.cRLIssuer field tells the RP that some CRLs from the named CRL issuer
should cover this certificate, but it does not tell the RP that all CRLs do.

P.S. A CRL issuer may as well use the same name as the CA if it is only ever
going to issue revocation info for that CA's certificates.  That is, the CA
delegates CRL issuance to a separate key, not to a separate name.  This
avoids CRL-DP.cRLIssuer, IDP.indirectCRL & CRL-ENTRY.certificateIssuer
fields completely.