Subject: RE: Certificates in CRLs

From: Sharon Boeyen <[email-masked]>
Date: Thu, 4 Jan 2007 11:36:04 -0500

I still think wasted bandwidth is also an issue. Forcing the download of
'fat' CRLs on clients when, in many cases, those clients already have the
certificates locally that caused the bloating of the CRL, is an unnecessary
waste.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Stefan Santesson
Sent: Wednesday, January 03, 2007 9:58 AM
To: Russ Housley
Cc: [email-masked]
Subject: RE: Certificates in CRLs

Russ,

In theory, the CA can put different pointers to different CRLs in each
certificate if some certificates are prime targets for frequent checking.
But I don't think that is a common scenario.

My point is that in order to allow free selection of CRLs, you would have to
add capability to the CDP extension rather than to the CRL. I don't think
such effort is worth the trouble.

I'm convinced that including certs in a CRL will only be made in situations
where it in the sum of all, helps increase efficiency and where the extra
bandwidth consumed is not an issue.

I read the critique of this idea as not really be a bandwidth issue, but
that some implementers simply don't want to be faced with the requirement to
implement this feature. But I don't see that they have to. A CRL with certs
in a non-critical extension should work just as well in current clients as
any current CRL without certs. The extension can simply be ignored.

This is not a necessary feature, but a practical one offering performance
improvements in some environments at no loss of interoperability.

Stefan Santesson
Senior Program Manager
Windows Security, Standards

> -----Original Message-----
> From: Russ Housley [mailto:[email-masked]]
> Sent: den 21 december 2006 16:19
> To: Stefan Santesson
> Cc: [email-masked]
> Subject: RE: Certificates in CRLs
>
> Stefan:
>
> If the CA chooses to offer both, how can the RP determine which one it 
> will get?  Does the CA post them in different LDAP attributes?
>
> Russ
>
> At 08:00 AM 12/21/2006, Stefan Santesson wrote:
>
> >As with anything else, the relying party can get what the CA offers.
> >
> >I don't think there is any realistic scenario where the CA has a 
> >reason to offer CRLs both with and without certificates. To offer 
> >this capability to RP is however not a matter for this protocol. It 
> >would be a matter for the CRL referencing model, i.e. CDP and/or 
> >directory schema.
> >
> >I don't think that extra complexity however is very useful.
> >
> >Stefan Santesson
> >Senior Program Manager
> >Windows Security, Standards
> >
> >
> > > -----Original Message-----
> > > From: [email-masked] [mailto:owner-ietf- 
> > > [email-masked]] On Behalf Of Denis Pinkas
> > > Sent: den 20 december 2006 17:05
> > > To: [email-masked]
> > > Subject: Re: Certificates in CRLs
> > >
> > >
> > >
> > > It is necessary to provide relying parties with the choice to get 
> > > :
> > >
> > >   - CRLs "as usual", or
> > >   - CRLs that carry that new extension.
> > >
> > > The current proposal does not allow for it.
> > >
> > > Until the draft is changed, I am against the addition of this work
> item
> > > to the program of the PKIX WG.
> > >
> > > Denis
> > >
> > >
> ______________________________________________________________________
> _
> > > _______
> > >
> > > >Since last IETF a new draft was posted:
> > > >http://www.ietf.org/internet-drafts/draft-santesson-pkix-vccrl-
> 00.txt
> > > >
> > > >There is a request to add this draft to the PKIX work and I would
> > > encourage to start the discussion about this decision in this
> thread.
> > > >
> > > >Stefan Santesson
> > > >Senior Program Manager
> > > >Windows Security, Standards
> > >
> > >
> > >

---

From: Stefan Santesson <[email-masked]>
Date: Fri, 5 Jan 2007 13:01:20 +0000

We are only talking about an extra 16K at most. The download time is the absolute most cases is negligible.
For those cases where this solution makes sense, the network bandwidth issue is not a problem.

For the cases where this would be an issue, this solution would not be used.

On the contrary, in some networks and scenarios, this will improve performance. Especially in high latency networks with PKI based peer-peer authentication where an extra retrieval cost way more performance than the expanded CRL size.

Also, many clients are configured to pre-fetch CRL:s before they are used, using idle time on the network at no extra cost.

Stefan Santesson
Senior Program Manager

From: Sharon Boeyen [mailto:[email-masked]]
Sent: den 4 januari 2007 17:36
To: Stefan Santesson; Russ Housley
Cc: [email-masked]
Subject: RE: Certificates in CRLs

I still think wasted bandwidth is also an issue. Forcing the download of 'fat' CRLs on clients when, in many cases, those clients already have the certificates locally that caused the bloating of the CRL, is an unnecessary waste.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Stefan Santesson
Sent: Wednesday, January 03, 2007 9:58 AM
To: Russ Housley
Cc: [email-masked]
Subject: RE: Certificates in CRLs

Russ,

In theory, the CA can put different pointers to different CRLs in each certificate if some certificates are prime targets for frequent checking. But I don't think that is a common scenario.

My point is that in order to allow free selection of CRLs, you would have to add capability to the CDP extension rather than to the CRL. I don't think such effort is worth the trouble.

I'm convinced that including certs in a CRL will only be made in situations where it in the sum of all, helps increase efficiency and where the extra bandwidth consumed is not an issue.

I read the critique of this idea as not really be a bandwidth issue, but that some implementers simply don't want to be faced with the requirement to implement this feature. But I don't see that they have to. A CRL with certs in a non-critical extension should work just as well in current clients as any current CRL without certs. The extension can simply be ignored.

This is not a necessary feature, but a practical one offering performance improvements in some environments at no loss of interoperability.

Stefan Santesson
Senior Program Manager

---

From: "Kemp, David P." <[email-masked]>
Date: Fri, 5 Jan 2007 10:54:18 -0500

Wouldn't it be better for the IETF to accept as a work item a general
purpose optimization that works everywhere, rather than a point solution
that works for high-bandwidth high-latency scenarios but fails for low
bandwidth scenarios?  Are you saying that where both network bandwidth
and latency are issues and this solution is not used, a different
solution should be used to solve the same problem?

I disagree with that philosophy.  If PKIX is going to stand behind an
optimization approach, the approach should be suitable for both high and
low bandwidth environments.

Dave

  _____  

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stefan Santesson
Sent: Friday, January 05, 2007 8:01 AM
To: Sharon Boeyen; Russ Housley
Cc: [email-masked]
Subject: RE: Certificates in CRLs

We are only talking about an extra 16K at most. The download time is the
absolute most cases is negligible. 

For those cases where this solution makes sense, the network bandwidth
issue is not a problem.

For the cases where this would be an issue, this solution would not be
used.

On the contrary, in some networks and scenarios, this will improve
performance. Especially in high latency networks with PKI based
peer-peer authentication where an extra retrieval cost way more
performance than the expanded CRL size.

Also, many clients are configured to pre-fetch CRL:s before they are
used, using idle time on the network at no extra cost.

Stefan Santesson

Senior Program Manager

I still think wasted bandwidth is also an issue. Forcing the download of
'fat' CRLs on clients when, in many cases, those clients already have
the certificates locally that caused the bloating of the CRL, is an
unnecessary waste.

-----Original Message----- 
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stefan Santesson 
Sent: Wednesday, January 03, 2007 9:58 AM 
To: Russ Housley 
Cc: [email-masked] 
Subject: RE: Certificates in CRLs 

Russ, 

In theory, the CA can put different pointers to different CRLs in each
certificate if some certificates are prime targets for frequent
checking. But I don't think that is a common scenario.

My point is that in order to allow free selection of CRLs, you would
have to add capability to the CDP extension rather than to the CRL. I
don't think such effort is worth the trouble.

I'm convinced that including certs in a CRL will only be made in
situations where it in the sum of all, helps increase efficiency and
where the extra bandwidth consumed is not an issue.

I read the critique of this idea as not really be a bandwidth issue, but
that some implementers simply don't want to be faced with the
requirement to implement this feature. But I don't see that they have
to. A CRL with certs in a non-critical extension should work just as
well in current clients as any current CRL without certs. The extension
can simply be ignored.

This is not a necessary feature, but a practical one offering
performance improvements in some environments at no loss of
interoperability.

Stefan Santesson 
Senior Program Manager