Subject: draft-pinkas-pkix-conf-crl-validation-02.txt is available

From: "Denis Pinkas" <[email-masked]>
Date: Thu, 21 Jul 2005 15:27:24 +0100

<draft-pinkas-pkix-conf-crl-validation-02.txt> is now available at:
http://www.ietf.org/internet-drafts/draft-pinkas-pkix-conf-crl-validation-02.txt

There is a common section for any kind of CRL.
 See section 6.3.3.1  CRL Processing start for all applications

Note that "old CRLs" may be selected in that phase and this may be quite useful, 
if it can be found that the target certificate was already revoked some time ago.
Note also that more than one CRL may be found in the local cache. 
The current algorithm does not support these cases because it is making 
incorrect-different-others assumptions.
 
Then the document makes a clear distinction between three kinds of processing 
where the complexity goes from simple to complex:

1 - What conformant applications shall support. This covers CRLs that contain certificates 
    from a single CA. The CRL may be issued by the CA or by a CRL issuer (that is not a CA) 
    designated by a CA.  
    
    See section 6.3.3.2  CRL Processing for conforming applications.

2 - If an application supports Certificate Issuer CRL entry extensions, then this section applies.
    This covers CRLs that *may* contain certificates from more than one CA.
   
    See section 6.3.3.3. CRL Processing for applications supporting 
    Certificate Issuer CRL entry extensions.

3 - If an application supports delta-CRLs. I have left the details for David Copper 
    who is much more expert than I am on that topic.
 
    See the nearly empty section 6.3.3.4. CRL Processing for applications supporting delta CRLs.

Note : Santosh, please read section 6.3.3.3. and you will see that it is possible 
          to go backwards looking for Certificate Issuer CRL entry extensions.

Denis

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 21 Jul 2005 17:53:47 -0400

Denis,

I would not have time to read things other than those that are tied to 3280.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Denis Pinkas
Sent: Thursday, July 21, 2005 10:27 AM
To: pkix
Subject: draft-pinkas-pkix-conf-crl-validation-02.txt is available

<draft-pinkas-pkix-conf-crl-validation-02.txt> is now available at:
http://www.ietf.org/internet-drafts/draft-pinkas-pkix-conf-crl-validation-02
.txt

Note that "old CRLs" may be selected in that phase and this may be quite
useful, 
if it can be found that the target certificate was already revoked some time
ago. Note also that more than one CRL may be found in the local cache. 
The current algorithm does not support these cases because it is making 
incorrect-different-others assumptions.
 
Then the document makes a clear distinction between three kinds of
processing 
where the complexity goes from simple to complex:

1 - What conformant applications shall support. This covers CRLs that
contain certificates 
    from a single CA. The CRL may be issued by the CA or by a CRL issuer
(that is not a CA) 
    designated by a CA.  

2 - If an application supports Certificate Issuer CRL entry extensions, then
this section applies.
    This covers CRLs that *may* contain certificates from more than one CA.

3 - If an application supports delta-CRLs. I have left the details for David
Copper 
    who is much more expert than I am on that topic.
 
    See the nearly empty section 6.3.3.4. CRL Processing for applications
supporting delta CRLs.

Note : Santosh, please read section 6.3.3.3. and you will see that it is
possible 
          to go backwards looking for Certificate Issuer CRL entry
extensions.

Denis