Subject: Correction to be done to <draft-pinkas-pkix-conf-crl-validation-01.txt>

From: Denis Pinkas <[email-masked]>
Date: Fri, 15 Jul 2005 10:24:15 +0200

A correction needs to be done to 
<draft-pinkas-pkix-conf-crl-validation-01.txt>.

As explained in a previous e-mail, the certificate issuer name
cannot default to the name of the CRL issuer, hence the following text 
extracted from section 6.3.3.3 is incorrect :

        (ii) check if there exists a previous CRL entry
             and if that CRL entry contains a Certificate
             Issuer CRL entry extension and go back to (1).

                If there is no previous CRL entry, then
                check if the name of the issuer of the CRL
                matches the name of the issuer field of the
                target certificate.

                 - If it does, then set the cert_revoc_status
                   variable to REVOKED and if the CRL entry
                   extension " reasonCode " is present in
                   that CRL entry, then set the revoc_reason
                   variable to the value contained in that CRL
                   entry extension and the algorithm
                   terminates.

                 - If it does, then set the cert_revoc_status
                   variable to NOT_REVOKED and the algorithm
                   terminates.

It would need to be corrected (and greatly simplified)
in the following way:

          (ii) If there is no previous CRL entry, then
               this is an error in the structure of the CRL
               and the algorithm terminates.

               Otherwise, check if that CRL entry contains
               a Certificate Issuer CRL entry extension and
               go back to (1).

Denis

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 15 Jul 2005 13:08:30 -0400

Denis,

The indirect CRL state machine is as follows:

	initial value of certificate_issuer_state = issuer field in the CRL
(1)
	
	certificate_issuer  = value in the CRL entry extension and if the
extension is absent, certificate_issuer = certificate_issuer_state (2)

	certificate_issuer_state = certificate_issuer

It is secure, standard compliant and provides for interoperability.  It is
probably too complex in comparison to doing nothing and yet to be defined
Denis's algorithms on a variety of CRL processing matters.

If the indirect CRL issuer is not a CA, the first revoked certificate entry
will contain a CRL issuer field.  There are numerous other situations when
first revoked certificate entry will contain a CRL issuer field, but this is
of no interest to a relying party that wants to write a secure,
interoperable, simple (i.e., not complex) CRL processing logic.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Denis Pinkas
Sent: Friday, July 15, 2005 4:24 AM
To: pkix
Subject: Correction to be done to
<draft-pinkas-pkix-conf-crl-validation-01.txt>

As explained in a previous e-mail, the certificate issuer name cannot
default to the name of the CRL issuer, hence the following text 
extracted from section 6.3.3.3 is incorrect :

Denis