Subject: RE: Signer certificate discovery for CRLs

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 27 Oct 2004 13:01:52 +0100

Denis,

Yes, SIA could be an option in SOME cases, if properly implemented and
if combined with an appropriate directory infrastructure.

It's just not as generic and cost effective as AIA in CRLs, especially
not when building chains from bottom up, which is a common way to build
paths.

I'm not trying to pick on words here. But for the first time I got the
impression that you accept AIA in CRLs as a valid option.

Do you still claim that AIA in CRLs is an invalid option that should NOT
be allowed?

/Stefan

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Denis Pinkas
> Sent: den 27 oktober 2004 09:32
> To: Stefan Santesson
> Cc: pkix
> Subject: Re: Signer certificate discovery for CRLs
> 
> 
> Stefan,
> 
> > Denis,
> 
> > <snip>
> 
> >>Use of AIA in CRLs would be one way to do it, while the use of SIA
> >>in CA certificates is the other way.
> 
> > I'm pleased to read that you acknowledge AIA in CRLs as a valid
option.
> > That is all I ask for.
> 
> I'm pleased to read that you noticed that AIA *would be an option*
since I
> used "would be" in the case of AIA and "is" in the case of SIA:
> 
> Use of AIA in CRLs *would be* one way to do it, while the use of SIA
> in CA certificates *is* the other way.  :-)
> 
> Denis
> 
> > Stefan Santesson
> > Microsoft Security Center of Excellence (SCOE)

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 27 Oct 2004 14:24:16 +0200

Stefan,

> if combined with an appropriate directory infrastructure.

You sentence is not correct.

"SIA could be an option in SOME cases, if properly implemented and if 
combined with an appropriate *repository* infrastructure".

> not when building chains from bottom up, which is a common way to build

Of course since SIA is used to build chain top down ! (which is a common way 
to build paths).

> impression that you accept AIA in CRLs as a valid option.

Not exactly. AIA in CRLs COULD be a valid option.

> Do you still claim that AIA in CRLs is an invalid option that should NOT

I never claimed such a sentence, so I do not need to disclaim it. :-|

Before accepting AIA as a valid option for CRLs we have to say how and when 
it would be used. The issue is MUCH MORE complicated than simply adding AIA 
in CRLs, since we have to give the processing rules for that extension.

Upon this aspect, we are far from an agreement and this is of course 
strongly related to the (lack of a) CRL processing model.

So we need first to say how we verify that a CRL Issuer is the right CRL 
Issuer (see my e-mail fom this morning to Santosh). Once we will have fixed 
that, then we will be able to explore the advantages and disavantages of 
including or not AIA in CRLs.

Denis

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 27 Oct 2004 16:16:42 -0400

Denis,

See responses in-line in [SC:]

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Denis Pinkas
Sent: Wednesday, October 27, 2004 8:24 AM
To: Stefan Santesson
Cc: pkix
Subject: Re: Signer certificate discovery for CRLs

> not when building chains from bottom up, which is a common way to 
> build paths.

to build paths).

[SC: Says who?  Most folks build paths from subscriber certificate to RP
trust anchor.]

> Do you still claim that AIA in CRLs is an invalid option that should 
> NOT be allowed?

[SC: The issue is simple and straightforward.  Just the way signed CMS
permits to carry signer's certificate, AIA in CRL simply points to the
signer certificate.  You can use that pointer and develop the path whichever
way you like]

[SC: What specifically do you disagree with and why?  There is a CRL
processing model.  It is well articulated in X.509 Annex B and well
summarized in 3280]

[SC: We have done this in this thread and by the briefing.]

Denis

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 28 Oct 2004 16:00:57 +0200

Santosh,

See responses in-line in [DP:]

(text deleted)

[DP: There is no CRL processing model. It is not summarized in 3280.
This is a major problem of 3280].

[DP: No. We still need to say how we verify that a CRL Issuer is the right 
CRL Issuer]. I fear a myriad of different models.

Denis

PS: David, I copied this message to you since you are making a list of 
issues related to RFC 3280. This is certainly a major one: clarification on 
CRL processing when the CRL Issuer is not the CA that has issued the 
certificate is needed.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 28 Oct 2004 15:33:27 -0400

X.509 Annex B and 3280 do describe how to deal with various CRLs.

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]] 
Sent: Thursday, October 28, 2004 10:01 AM
To: Santosh Chokhani
Cc: 'pkix'; David A. Cooper
Subject: Re: Signer certificate discovery for CRLs

Santosh,

(text deleted)

[DP: There is no CRL processing model. It is not summarized in 3280. This is
a major problem of 3280].

Denis