Subject: RE: Certificates in CRLs

From: Stefan Santesson <[email-masked]>
Date: Wed, 3 Jan 2007 14:58:27 +0000

Russ,

In theory, the CA can put different pointers to different CRLs in each certificate if some certificates are prime targets for frequent checking. But I don't think that is a common scenario.

My point is that in order to allow free selection of CRLs, you would have to add capability to the CDP extension rather than to the CRL. I don't think such effort is worth the trouble.

I'm convinced that including certs in a CRL will only be made in situations where it in the sum of all, helps increase efficiency and where the extra bandwidth consumed is not an issue.

I read the critique of this idea as not really be a bandwidth issue, but that some implementers simply don't want to be faced with the requirement to implement this feature. But I don't see that they have to. A CRL with certs in a non-critical extension should work just as well in current clients as any current CRL without certs. The extension can simply be ignored.

This is not a necessary feature, but a practical one offering performance improvements in some environments at no loss of interoperability.

Stefan Santesson
Senior Program Manager
Windows Security, Standards

> -----Original Message-----
> From: Russ Housley [mailto:[email-masked]]
> Sent: den 21 december 2006 16:19
> To: Stefan Santesson
> Cc: [email-masked]
> Subject: RE: Certificates in CRLs
>
> Stefan:
>
> If the CA chooses to offer both, how can the RP determine which one
> it will get?  Does the CA post them in different LDAP attributes?
>
> Russ
>
> At 08:00 AM 12/21/2006, Stefan Santesson wrote:
>
> >As with anything else, the relying party can get what the CA offers.
> >
> >I don't think there is any realistic scenario where the CA has a
> >reason to offer CRLs both with and without certificates.
> >To offer this capability to RP is however not a matter for this
> >protocol. It would be a matter for the CRL referencing model, i.e.
> >CDP and/or directory schema.
> >
> >I don't think that extra complexity however is very useful.
> >
> >Stefan Santesson
> >Senior Program Manager
> >Windows Security, Standards
> >
> >
> > > -----Original Message-----
> > > From: [email-masked] [mailto:owner-ietf-
> > > [email-masked]] On Behalf Of Denis Pinkas
> > > Sent: den 20 december 2006 17:05
> > > To: [email-masked]
> > > Subject: Re: Certificates in CRLs
> > >
> > >
> > >
> > > It is necessary to provide relying parties with the choice to get :
> > >
> > >   - CRLs "as usual", or
> > >   - CRLs that carry that new extension.
> > >
> > > The current proposal does not allow for it.
> > >
> > > Until the draft is changed, I am against the addition of this work
> item
> > > to the program of the PKIX WG.
> > >
> > > Denis
> > >
> > >
> _______________________________________________________________________
> > > _______
> > >
> > > >Since last IETF a new draft was posted:
> > > >http://www.ietf.org/internet-drafts/draft-santesson-pkix-vccrl-
> 00.txt
> > > >
> > > >There is a request to add this draft to the PKIX work and I would
> > > encourage to start the discussion about this decision in this
> thread.
> > > >
> > > >Stefan Santesson
> > > >Senior Program Manager
> > > >Windows Security, Standards
> > >
> > >
> > >

---

From: "Denis Pinkas"<[email-masked]>
Date: Wed, 3 Jan 2007 17:28:29 +0100

Stefan,

We have been asking for weeks for a way forward so that "normal" CRLs can still be obtained, 
even if the CA has chosen to issue CRLs with certificates in addition to CRLs as they are today.

If you want the draft to progress on the standard track and as a WG draft, you would save us much time, 
if you could propose such a way forward. Adding a capability to the CDP extension would probably a way forward.

Denis

----- Message reçu ----- 
De : owner-ietf-pkix 
À : Russ Housley 
Date : 2007-01-03, 15:58:27
Sujet : RE: Certificates in CRLs

Russ,

Stefan Santesson
Senior Program Manager