Subject: RE: Online Certificate Revocation Protocol

From: Tony Bartoletti <[email-masked]>
Date: Mon, 11 Jun 2001 11:10:31 -0700

At 12:01 PM 6/11/01 -0400, Santosh Chokhani wrote:
>Revocation of a public key certificate whose companion key has been 
>destroyed is a BAD idea.
>
>For example, if the subject of the key is a CA, revocation of that public 
>key certificate could cause denial of service for all the certificates 
>issued by that CA.  There is nothing wrong with the certificates.

I admit I'm on the fence here, but one should be able to "revoke the 
certificate" only in terms that mean "any signatures created after that 
point are invalid", without interfering with the ability to use the public 
key to continue verifying previously signed objects.

This suggests that CAs (or someone) should provide an historical "was valid 
between" service.  This would mitigate the DoS issue.

___tony___

Tony Bartoletti 925-422-3881 <[email-masked]>
Information Operations, Warfare and Assurance Center
Lawrence Livermore National Laboratory
Livermore, CA 94551-9900

---

From: Marc Branchaud <[email-masked]>
Date: Mon, 11 Jun 2001 13:54:09 -0700

> between" service.  This would mitigate the DoS issue.

<can contents="worms">

There could conceivably be a "key destroyed" revocation reason to handle this
situation.  The problem is that you can't tell from the validity period of a
certificate exactly when the CA issued that cert.  An honest CA will put
accurate validity periods in its certs, but if a CA's key is compromised then
the attacker can issue certs for any period of time.  Once compromised, the
certificate should be properly revoked.

So here's a proposal:

If a key (CA's or otherwise) is destroyed, place the certificate on a CRL
with a "key destroyed" reason.  This indicates that any certificates issued
by that key on or after the time of destruction should be considered invalid.

If, before the key's certificate expires, the key is actually compromised,
issue a new CRL with a "key compromised" revocation reason.  This fully
revokes the certificate, with all that implies.

</can>

		Marc

---

From: Massimiliano Pala <[email-masked]>
Date: Tue, 12 Jun 2001 00:44:17 +0200

> >Revocation of a public key certificate whose companion key has been

I think that destroying deliberately its own key and incidentally are
different cases. I think the second is to be considered a "loose of
control" of the key -- to me SHOULD be revoked. Could we think adding
a CRL extension for this scenario (keyDestroyed) ???

> key to continue verifying previously signed objects.

I agree with you -- and actually I think many laws on digital signature
means that when talking about certificate revocation.
 
> between" service.  This would mitigate the DoS issue.

This could be done having an archive of the issued certificates and CRLs the
validity period of a revoked certificate will be notBefore -> revDate. Many
laws also require archives to keep information for at least 10 years. At
least in Europe.

-- 

C'you,

	Massimiliano Pala

--o-------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager]                [email-masked]
                                                     [email-masked]
http://www.openca.org                            Tel.:   +39 (0)59  270  094
http://openca.sourceforge.net                    Mobile: +39 (0)347 7222 365

---

From: Marc Branchaud <[email-masked]>
Date: Mon, 11 Jun 2001 16:36:24 -0700

> revokes the certificate, with all that implies.

Perhaps the existing cessationOfOperation code could be used as a "key
destroyed" reason.  X.509 states: "cessationOfOperation indicates that the
certificate is no longer needed for the purpose for which it was issued but
there is no cause to suspect that the private key has been compromised." 
That doesn't quite fit, but it might work.

		Marc