Subject: Re: Certificates in CRLs

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 5 Jan 2007 15:27:56 +0100

We are only talking about an extra 16K at most. The download time is the absolute most cases is negligible. 
For those cases where this solution makes sense, the network bandwidth issue is not a problem.
For the cases where this would be an issue, this solution would not be used.
Stefan,
What you say just above is untrue. CAs are issuing CRLs for all kind of RPs and 
would be unable to handle cases where some RPs have a large network bandwith 
and some others don't.
Your proposed individual draft does not propose a solution where a CA would be able to issue 
simultaneously two kinds of CRLs: "slim", as today, and "fat", as you are proposing for tomorrow.
Denis

On the contrary, in some networks and scenarios, this will improve performance. Especially in high latency networks with PKI based peer-peer authentication where an extra retrieval cost way more performance than the expanded CRL size.
 
Also, many clients are configured to pre-fetch CRL:s before they are used, using idle time on the network at no extra cost.

Stefan Santesson
Senior Program Manager
Windows Security, Standards
 
From: Sharon Boeyen [mailto:[email-masked]] 
Sent: den 4 januari 2007 17:36
To: Stefan Santesson; Russ Housley
Cc: [email-masked]
Subject: RE: Certificates in CRLs
 
I still think wasted bandwidth is also an issue. Forcing the download of 'fat' CRLs on clients when, in many cases, those clients already have the certificates locally that caused the bloating of the CRL, is an unnecessary waste.
-----Original Message----- 
From: [email-masked] [mailto:[email-masked]] On Behalf Of Stefan Santesson 
Sent: Wednesday, January 03, 2007 9:58 AM 
To: Russ Housley 
Cc: [email-masked] 
Subject: RE: Certificates in CRLs 
 
Russ, 
In theory, the CA can put different pointers to different CRLs in each certificate if some certificates are prime targets for frequent checking. But I don't think that is a common scenario.
My point is that in order to allow free selection of CRLs, you would have to add capability to the CDP extension rather than to the CRL. I don't think such effort is worth the trouble.
I'm convinced that including certs in a CRL will only be made in situations where it in the sum of all, helps increase efficiency and where the extra bandwidth consumed is not an issue.
I read the critique of this idea as not really be a bandwidth issue, but that some implementers simply don't want to be faced with the requirement to implement this feature. But I don't see that they have to. A CRL with certs in a non-critical extension should work just as well in current clients as any current CRL without certs. The extension can simply be ignored.
This is not a necessary feature, but a practical one offering performance improvements in some environments at no loss of interoperability.
 
Stefan Santesson 
Senior Program Manager 
Windows Security, Standards 
 
> -----Original Message----- 
> From: Russ Housley [mailto:[email-masked]] 
> Sent: den 21 december 2006 16:19 
> To: Stefan Santesson 
> Cc: [email-masked] 
> Subject: RE: Certificates in CRLs 
> 
> Stefan: 
> 
> If the CA chooses to offer both, how can the RP determine which one it 
> will get?  Does the CA post them in different LDAP attributes? 
> 
> Russ 
> 
> At 08:00 AM 12/21/2006, Stefan Santesson wrote: 
> 
> >As with anything else, the relying party can get what the CA offers. 
> > 
> >I don't think there is any realistic scenario where the CA has a 
> >reason to offer CRLs both with and without certificates. To offer 
> >this capability to RP is however not a matter for this protocol. It 
> >would be a matter for the CRL referencing model, i.e. CDP and/or 
> >directory schema. 
> > 
> >I don't think that extra complexity however is very useful. 
> > 
> >Stefan Santesson 
> >Senior Program Manager 
> >Windows Security, Standards 
> > 
> > 
> > > -----Original Message----- 
> > > From: [email-masked] [mailto:owner-ietf- 
> > > [email-masked]] On Behalf Of Denis Pinkas 
> > > Sent: den 20 december 2006 17:05 
> > > To: [email-masked] 
> > > Subject: Re: Certificates in CRLs 
> > > 
> > > 
> > > 
> > > It is necessary to provide relying parties with the choice to get 
> > > : 
> > > 
> > >   - CRLs "as usual", or 
> > >   - CRLs that carry that new extension. 
> > > 
> > > The current proposal does not allow for it. 
> > > 
> > > Until the draft is changed, I am against the addition of this work 
> item 
> > > to the program of the PKIX WG. 
> > > 
> > > Denis 
> > > 
> > > 
> ______________________________________________________________________ 
> _ 
> > > _______ 
> > > 
> > > >Since last IETF a new draft was posted: 
> > > >http://www.ietf.org/internet-drafts/draft-santesson-pkix-vccrl- 
> 00.txt 
> > > > 
> > > >There is a request to add this draft to the PKIX work and I would 
> > > encourage to start the discussion about this decision in this 
> thread. 
> > > > 
> > > >Stefan Santesson 
> > > >Senior Program Manager 
> > > >Windows Security, Standards 
> > > 
> > > 
> > >

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 9 Jan 2007 21:46:27 +0000

Denis,

I think we view completely different PKI environments.
I'm not primary focusing on public PKI solutions.

I'm primary focused on the environments that makes up a large majority of all PKI deployments, the enterprise environment which might be everything from deployment of wireless security, IPsec, Remote access VPNs, Network Health certificates, Terminal Server security over TLS, secure e-mail, PKINIT Kerberos, etc.

In many such corporate environment it is possible to determine if embedded certificates are beneficial to the system or not.

I simply do not believe in adding another choice to the client to choose CRL with or without certificate. Thus such option is not specified.

Stefan Santesson
Senior Program Manager

From: [email-masked] [mailto:[email-masked]] On Behalf Of Denis Pinkas
Sent: den 5 januari 2007 06:28
To: [email-masked]
Subject: Re: Certificates in CRLs

________________________________

Stefan Santesson
Senior Program Manager

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Stefan Santesson
Sent: Wednesday, January 03, 2007 9:58 AM
To: Russ Housley
Cc: [email-masked]
Subject: RE: Certificates in CRLs

Russ,

Stefan Santesson
Senior Program Manager

> > > to the program of the PKIX WG.

________________________________