Subject: CRL reason codes

From: [email-masked] (Peter Gutmann)
Date: Sun, 3 Jan 1999 05:22:49 (NZDT)

While I was playing with CRL's today I found a somewhat annoying problem in 
the way the CRL reasons are defined: In two different locations they're 
defined as either an enumerated type (CRLReason) or a bit string 
(ReasonFlags).  What this means is that a name like 'affiliationChanged' can 
be associated with the value 8 for a ReasonFlag but 3 for a CRLReason.  This 
makes it a real pain for programmers because even with fascist range checking 
in the code it's quite possible to pass in a ReasonFlags keyCompromise where a 
function is expecting a CRLReason keyCompromise (you just end up with a 
'superseded' instead).  I can't think of any easy solution for this, but 
perhaps changing the ReasonFlags names so they end in 'Flag' (eg 
affiliationChanged vs affiliationChangedFlag) would help a bit.
 
Another question about CRL's, what happens when a CA with a self-signed cert 
revokes its own cert?  Is the cert regarded as valid for the purposes of 
authenticating the CRL, but invalid a few microseconds later once its 
revocation is read from the CRL?  
 
Peter.