Subject: RE: Revoking bogus certificates

From: [email-masked] (Peter Gutmann)
Date: Tue, 19 Jun 2001 19:36:13 (NZST)

Ambarish Malpani <[email-masked]> writes:
 
>    If the behavior you are trying to get the application to
>exhibit is reject signatures associated with the offending
>certificate, you should get that behavior with any application
>that does the right thing with that extension in the CRL/OCSP
>response.
 
It's not just reject signatures, I want them to know that nothing in the cert 
is, or was, ever valid.  For example lets say I get a cert from you which has 
a CRL somewhere with a reason code of keyCompromise.  That means that although 
the sig should be regarded as invalid, there is a real Ambarish Malpani (or 
someone who can fake email from him to the list :-) who is not a CA, who works 
for Valicert, etc etc etc.  OTOH if the revocation code is affiliationChanged 
then it means there's still a real Ambarish Malpani who is not a CA but he 
doesn't work for Valicert any more (in fact if there isn't any Ambarish 
Malpani at all there's no way to indicate what the problem is - again there's 
that assumption that CAs never make mistakes).  The other reasonCodes (most of 
which aren't too useful anyway) follow logically.  What neverValid means is 
keyCompromise | affiliationChanged | nameWrong | caStatusWrong | [everything 
else in the cert wrong] all at the same time.
 
(Looking through the codes again, what *is* a caCompromise, as opposed to a 
keyCompromise?  Could this be used for neverValid (caCompromise implies they 
issued the cert in error)?  OTOH a CMP-style "undo" isn't really a 
caCompromise, and it's possible that many CAs won't like using a reason code 
which implies they screwed up).
 
Peter.

---

From: Rich Salz <[email-masked]>
Date: Tue, 19 Jun 2001 08:04:37 -0400

If Peter is correct about CMP -- the EE can reject the cert after the CA
signs it -- then I do not see we CANNOT have "neverValid."
	/r$

---

From: "Paul Gogarty" <[email-masked]>
Date: Wed, 20 Jun 2001 12:14:13 +0100

> which implies they screwed up).

It was my understanding that caCompromise signalled that the certificate had
been revoked because the private key of the CA had become compromised. This
is not to say that one has to revoke all the certs under a CA if its private
key is compromised but allows for this policy to be adopted by CAs if they
wish.

If I am wrong then which revocation cod should be used to signal a
certificate has been revoked due to a CA compromise?