Subject: RE: Removing expired certificates from CRLs.....

From: Sharon Boeyen <[email-masked]>
Date: Thu, 6 Sep 2001 09:24:43 -0400

There was a problem with my initial attempt to send this to the list, so I
am resending it.
 
Sharon
-----Original Message-----
From: Sharon Boeyen 
Sent: Wednesday, September 05, 2001 1:36 PM
To: 'Flynn, Michael'; 'Ryan Hurst'; IETF-PKIX
Subject: RE: Removing expired certificates from CRLs.....

I suspect some of the PKIX text was never updated to reflect the successful
ballot on the X.509 defect report that fixed this in the base X.509 text.
The approved TC for the defect (DR 204) corrected this problem by making the
following changes to X.509 (97).

Clause 12.6.3.1
 
In the first sentence following the ASN.1, delete "unexpired"
 
Add the following as a new second sentence in the first paragraph following
the ASN.1
 
"After a certificate appears on a CRL, it may be deleted from a subsequent
CRL after the certificate's expiry."

Cheers,
Sharon
 
-----Original Message-----
From: Flynn, Michael [mailto:[email-masked]]
Sent: Wednesday, September 05, 2001 1:03 PM
To: 'Ryan Hurst'; IETF-PKIX
Subject: RE: Removing expired certificates from CRLs.....

Ryan,
 
Ryan wrote::
Now logically it makes sense to remove certificates that are expired from
CRLs to control size, yes this has a negative point specifically it prevents
CRLs from being used as a non-repudiation source; but this is mute due to
many other issues.
 
At least regarding removing expired certs from CRLs, I would think that
non-repudiation can be satisfied by keeping the old CRLs in back up storage
for some length of time.  That time being how far back in time a contract
dispute might go; ten years, twenty?   So long as you could get them off
tape for the lawyers to look at the legal process would be satisfied, they
don't need to be online forever.  
 
Michael
 
-----Original Message-----
From: Ryan Hurst [mailto:[email-masked]]
Sent: Tuesday, September 04, 2001 8:50 PM
To: IETF-PKIX
Subject: Removing expired certificates from CRLs.....

I was speaking with Peter Williams today about the removal of expired
certificates from CRLs; I have always been under the belief that this
behavior was optional, I vaguely remembered reading text in 2459 along those
lines; additionally I know of several commercial CAs that do not remove the
expired certificates from their CRLs. Peter on the other hand was under the
impression that it was a mandate to remove CRLs; he too remembered reading
text in 2459 to support is position.
 
So we each pulled out the RFC and found that we were both right!
Specifically both sections 3.3 and 8.6.2.2 have text on this subject:
 
3.3  Revocation
When a certificate is issued, it is expected to be in use for its entire
validity period.  However, various circumstances may cause a certificate to
become invalid prior to the expiration of the validity period.
 
....
 
An entry is added to the CRL as part of the next update following
notification of revocation. An entry may be removed from the CRL after
appearing on one regularly scheduled CRL issued beyond the revoked
certificate's validity period.

8.6.2.2 Issuing distribution point extension
This CRL extension field identifies the CRL distribution point for this
particular CRL, and indicates if the CRL is limited to revocations for
end-entity certificates only, for authority certificates only, or for a
limited set of reasons only. The CRL is signed by the CRL issuer's key- CRL
distribution points do not have their own key pairs. However, for a CRL
distributed via the Directory, the CRL is stored in the entry of the CRL
distribution point, which may not be the directory entry of the CRL issuer.
If this field is absent, the CRL shall contain entries for all revoked
unexpired certificates issued by the CRL issuer.
 
....
 
The distributionPoint component contains the name of the distribution point
in one or more name forms. If this field is absent, the CRL shall contain
entries for all revoked certificates issued by the CRL issuer. After a
certificate appears on a CRL, it is deleted from a subsequent CRL after the
certificate's expiry.

Although section 8.6.2.2 is specifically in regards to CRLdps, any
difference between full CRLs and CRLdps in this case I feel would be an
arbitrary one. 
 
Now logically it makes sense to remove certificates that are expired from
CRLs to control size, yes this has a negative point specifically it prevents
CRLs from being used as a non-repudiation source; but this is mute due to
many other issues.
 
That being the case I think; and I believe Peter would agree the correct
thing to do is to remove these expired/revoked entries from the CRL. 
 
The question now is what is the PKIX stance on this matter?
 
Ryan M. Hurst
ValiCert, Inc.
 
"It may roundly be asserted that human ingenuity cannot concoct a cipher
which human ingenuity cannot resolve."
-Edgar Allan Poe

---

From: "Esposito Alfredo" <[email-masked]>
Date: Fri, 7 Sep 2001 11:01:33 +0200

The following statement (apart the underscore) is excerpted from "Recommendation X.509 (2000) | ISO/IEC 9594-8:2000
Draft Technical Corrigendum 3" that is currently on ballot.
This corrects the defects reported in defect report 280

Replace the existing subclause 8.6.2.2 with the following and make associated changes to the ASN.1 in Appendix A:

8 . 6 . 2 . 2 Issuing distribution point extension

This CRL extension field identifies the CRL distribution point for this particular CRL, and indicates if the CRL is indirect, or if it is limited to covering only a subset of the revocation information. The limitation may be based on a subset of the certificate population or on a subset of revocation reasons. The CRL is signed by the CRL issuer's key - CRL distribution points do not have their own key pairs. However, for a CRL distributed via the Directory, the CRL is stored in the entry of the CRL distribution point, which may not be the directory entry of the CRL issuer. If this field and the CRL scope field are both absent, the CRL shall contain entries for all revoked unexpired certificates issued by the CRL issuer.

Alfredo Esposito
[email-masked]

----- Original Message ----- 
  From: Sharon Boeyen 
  To: 'IETF-PKIX' 
  Sent: Thursday, September 06, 2001 3:24 PM
  Subject: RE: Removing expired certificates from CRLs.....

  There was a problem with my initial attempt to send this to the list, so I am resending it.

  Sharon
    -----Original Message-----
    From: Sharon Boeyen 
    Sent: Wednesday, September 05, 2001 1:36 PM
    To: 'Flynn, Michael'; 'Ryan Hurst'; IETF-PKIX
    Subject: RE: Removing expired certificates from CRLs.....

    I suspect some of the PKIX text was never updated to reflect the successful ballot on the X.509 defect report that fixed this in the base X.509 text. The approved TC for the defect (DR 204) corrected this problem by making the following changes to X.509 (97).

    Clause 12.6.3.1

    Add the following as a new second sentence in the first paragraph following the ASN.1

    "After a certificate appears on a CRL, it may be deleted from a subsequent CRL after the certificate's expiry."

    Cheers,
    Sharon

      -----Original Message-----
      From: Flynn, Michael [mailto:[email-masked]]
      Sent: Wednesday, September 05, 2001 1:03 PM
      To: 'Ryan Hurst'; IETF-PKIX
      Subject: RE: Removing expired certificates from CRLs.....

      Ryan,

      Ryan wrote::
      Now logically it makes sense to remove certificates that are expired from CRLs to control size, yes this has a negative point specifically it prevents CRLs from being used as a non-repudiation source; but this is mute due to many other issues.

      At least regarding removing expired certs from CRLs, I would think that non-repudiation can be satisfied by keeping the old CRLs in back up storage for some length of time.  That time being how far back in time a contract dispute might go; ten years, twenty?   So long as you could get them off  tape for the lawyers to look at the legal process would be satisfied, they don't need to be online forever.  

      Michael

        -----Original Message-----
        From: Ryan Hurst [mailto:[email-masked]]
        Sent: Tuesday, September 04, 2001 8:50 PM
        To: IETF-PKIX
        Subject: Removing expired certificates from CRLs.....

        I was speaking with Peter Williams today about the removal of expired certificates from CRLs; I have always been under the belief that this behavior was optional, I vaguely remembered reading text in 2459 along those lines; additionally I know of several commercial CAs that do not remove the expired certificates from their CRLs. Peter on the other hand was under the impression that it was a mandate to remove CRLs; he too remembered reading text in 2459 to support is position.

        So we each pulled out the RFC and found that we were both right! Specifically both sections 3.3 and 8.6.2.2 have text on this subject:

        3.3  Revocation

        When a certificate is issued, it is expected to be in use for its entire validity period.  However, various circumstances may cause a certificate to become invalid prior to the expiration of the validity period.

        ....

        An entry is added to the CRL as part of the next update following notification of revocation. An entry may be removed from the CRL after appearing on one regularly scheduled CRL issued beyond the revoked certificate's validity period.

        This CRL extension field identifies the CRL distribution point for this particular CRL, and indicates if the CRL is limited to revocations for end-entity certificates only, for authority certificates only, or for a limited set of reasons only. The CRL is signed by the CRL issuer's key- CRL distribution points do not have their own key pairs. However, for a CRL distributed via the Directory, the CRL is stored in the entry of the CRL distribution point, which may not be the directory entry of the CRL issuer. If this field is absent, the CRL shall contain entries for all revoked unexpired certificates issued by the CRL issuer.

        ....

        The distributionPoint component contains the name of the distribution point in one or more name forms. If this field is absent, the CRL shall contain entries for all revoked certificates issued by the CRL issuer. After a certificate appears on a CRL, it is deleted from a subsequent CRL after the certificate's expiry.

        Although section 8.6.2.2 is specifically in regards to CRLdps, any difference between full CRLs and CRLdps in this case I feel would be an arbitrary one. 

        Now logically it makes sense to remove certificates that are expired from CRLs to control size, yes this has a negative point specifically it prevents CRLs from being used as a non-repudiation source; but this is mute due to many other issues.

        That being the case I think; and I believe Peter would agree the correct thing to do is to remove these expired/revoked entries from the CRL. 

        Ryan M. Hurst

        ValiCert, Inc.

          "It may roundly be asserted that human ingenuity cannot concoct a cipher which human ingenuity cannot resolve."

          -Edgar Allan Poe