Subject: Re: RE: Correction to be done to <draft-pinkas-pkix-conf-crl-validation-01.txt>

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 26 Jul 2005 16:05:51 +0100

Santosh,

>All of the CRL and Indirect CRL related changes Dennis has proposed are not
>required, change the standard, make the standard less secure, and/or do not
>solve the issue of name collisions.

There is no demonstration of any of the above two assertions:
"make the standard less secure, and/or do not solve the issue of name collisions".

See another remark below.

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On
>Behalf Of Stephen Farrell
>Sent: Friday, July 22, 2005 11:07 AM
>To: Denis Pinkas
>Cc: Santosh Chokhani; David A. Cooper; Stefan Santesson; pkix
>Subject: Re: Correction to be done to
><draft-pinkas-pkix-conf-crl-validation-01.txt>
>
>Denis,
>
>> The point is not simply a vocabulary problem, but that that it is
>> possible *for a RP* to support CRLs issued by CRL Issuers that 
>> are not CAs, without the need to support the indirectCRL boolean 
>> and the certificate issuer CRL entry extension and this makes the 
>> algorithm simpler, easier to implement, faster, etc ...
>
>I think this'd be a bad idea. Aside from anything else, it assumes that some
>relationships between certificate and CRL issuers won't change over time.
>Those do change and if this were adopted the RP's wouldn't have a way to
>easily see that.

If they change, then the IDP extension is used and the problem is solved.
But in the simple case I am looking at, the point is to have one CRL Issuer 
servicing only one CA.

Denis

>Stephen.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Tue, 26 Jul 2005 12:02:30 -0400

Denis,

See responses in-line under [Santosh;]

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Denis Pinkas
Sent: Tuesday, July 26, 2005 11:06 AM
To: Santosh Chokhani; 'pkix'
Subject: Re: RE: Correction to be done to
<draft-pinkas-pkix-conf-crl-validation-01.txt>

Santosh,

>All of the CRL and Indirect CRL related changes Dennis has proposed are 
>not required, change the standard, make the standard less secure, 
>and/or do not solve the issue of name collisions.

There is no demonstration of any of the above two assertions: "make the
standard less secure, and/or do not solve the issue of name collisions".

[Santosh: As I responded to the previous posting and as I have responded to
other postings, your posting are changing the standard.  There is nothing
wrong with that per se.  But, folks need to agree to break backward
compatibility and change the standard.]

>From: [email-masked] 
>[mailto:[email-masked]] On Behalf Of Stephen Farrell
>> possible *for a RP* to support CRLs issued by CRL Issuers that are 
>> not CAs, without the need to support the indirectCRL boolean and the 
>> certificate issuer CRL entry extension and this makes the algorithm 
>> simpler, easier to implement, faster, etc ...
>
>I think this'd be a bad idea. Aside from anything else, it assumes that 
>some relationships between certificate and CRL issuers won't change 
>over time. Those do change and if this were adopted the RP's wouldn't 
>have a way to easily see that.

Denis