Subject: Re: Certificates in CRLs

From: "Denis Pinkas" <[email-masked]>
Date: Wed, 20 Dec 2006 17:04:41 +0100

It is necessary to provide relying parties with the choice to get :

  - CRLs "as usual", or
  - CRLs that carry that new extension.

The current proposal does not allow for it. 

Until the draft is changed, I am against the addition of this work item to the program of the PKIX WG.

Denis

______________________________________________________________________________

>Since last IETF a new draft was posted:
>http://www.ietf.org/internet-drafts/draft-santesson-pkix-vccrl-00.txt
>
>There is a request to add this draft to the PKIX work and I would encourage to start the discussion about this decision in this thread.
>
>Stefan Santesson
>Senior Program Manager
>Windows Security, Standards

---

From: Stefan Santesson <[email-masked]>
Date: Thu, 21 Dec 2006 13:00:22 +0000

As with anything else, the relying party can get what the CA offers.

I don't think there is any realistic scenario where the CA has a reason to offer CRLs both with and without certificates.
To offer this capability to RP is however not a matter for this protocol. It would be a matter for the CRL referencing model, i.e. CDP and/or directory schema.

I don't think that extra complexity however is very useful.

Stefan Santesson
Senior Program Manager

> -----Original Message-----
> From: [email-masked] [mailto:owner-ietf-
> [email-masked]] On Behalf Of Denis Pinkas
> Sent: den 20 december 2006 17:05
> To: [email-masked]
> Subject: Re: Certificates in CRLs
>
>
>
> >There is a request to add this draft to the PKIX work and I would
> encourage to start the discussion about this decision in this thread.
> >
> >Stefan Santesson
> >Senior Program Manager

---

From: "Kemp, David P." <[email-masked]>
Date: Thu, 21 Dec 2006 10:15:36 -0500

What's unrealistic about an RP that has a certificate (from a prior CRL)
not wishing to download that same certificate over and over again?

I agree with Denis - I am opposed to this work item unless it explicitly
addresses a standard mechanism to obtain the normal CRL.   In addition,
I am opposed because it is the wrong approach.   A bag of CRL and
certificate (e.g. a directory attribute that aggregates independent
data objects, a la crossCertificatePair) is the correct approach to
minimizing round trips.  Just because X.509 defines a flexible
extension mechanism does not mean that extensions are the proper
place for everything including the kitchen sink.

Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stefan Santesson
Sent: Thursday, December 21, 2006 8:00 AM
To: Denis Pinkas; [email-masked]
Subject: RE: Certificates in CRLs

I don't think there is any realistic scenario where the CA has a reason
to offer CRLs both with and without certificates.
To offer this capability to RP is however not a matter for this
protocol. It would be a matter for the CRL referencing model, i.e. CDP
and/or directory schema.

Stefan Santesson
Senior Program Manager

> Until the draft is changed, I am against the addition of this work
item
> to the program of the PKIX WG.
>
> Denis
>
>
_______________________________________________________________________
> _______

---

From: Russ Housley <[email-masked]>
Date: Thu, 21 Dec 2006 10:19:07 -0500

Stefan:

If the CA chooses to offer both, how can the RP determine which one 
it will get?  Does the CA post them in different LDAP attributes?

Russ

At 08:00 AM 12/21/2006, Stefan Santesson wrote:

>I don't think there is any realistic scenario where the CA has a 
>reason to offer CRLs both with and without certificates.
>protocol. It would be a matter for the CRL referencing model, i.e. 
>CDP and/or directory schema.
>