Subject: [pkix] How to handle sequence of distributionPoint's

From: Petr Pisar <[email-masked]>
Date: Mon, 5 Oct 2009 17:20:53 +0200

Hello,

I read RFC 3280 (Internet X.509 Public Key Infrastructure Certificate and
Certificate Revocation List (CRL) Profile) carefully and I'm not sure how
should application check certificate validity if there is more than one
DistributionPoint. Should application fetch CRLs from all DistributionPoint's
and check certificate against them, or one successfull DistributionPoint is
enough?

I understand situation with one DistributionPoint having more GeneralName's.
RFC states explicitly that such GenerlName's are equivalent. However RFC does
not say anything about multiple DistributionPoint's each having only one
GeneralName.

I think that multiple DistributionPoint's are designed for collection of
incomplete CRLs, thus application should check all of them. However there is
no clarification in given RFC.

And to get sharper edge, what's desired behaviour when all DistributionPoint's
have no reasons flag? I think there is no way how to signal to appliaction the
CRLs are partitioned on some internal organisation reasons (e.g. one CRL for
CA certificates only, another CRL for end user not-CA certficates), thus
appliaction should check all of them.

What's correct procedure?

-- Petr Pisar

---

From: "Timothy J. Miller" <[email-masked]>
Date: Mon, 5 Oct 2009 10:49:00 -0500

> no clarification in given RFC.

I know of PKIs that used multiple DistributionPoints as alternates, not 
distributing CRL portions.

-- Tim

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 5 Oct 2009 12:21:30 -0400

Petr,

You only need to check one (see exception below) as long as the CRL
retrieved is the appropriate one, i.e., either the IDP extension is
absent or if present, the DP in IDP matches the DP in the CRL DP or DP
in IDP is absent.

The exception is when CRL is partitioned by reason code.  We generally
should not do that.  But, if you do, you need to get all the partitions
whose reasons codes are of interest to the relying party (those
generally are all the reason codes).

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Petr Pisar
> Sent: Monday, October 05, 2009 11:21 AM
> To: [email-masked]
> Subject: [pkix] How to handle sequence of distributionPoint's
> 
> Hello,
> 
> I read RFC 3280 (Internet X.509 Public Key Infrastructure 
> Certificate and Certificate Revocation List (CRL) Profile) 
> carefully and I'm not sure how should application check 
> certificate validity if there is more than one 
> DistributionPoint. Should application fetch CRLs from all 
> DistributionPoint's and check certificate against them, or 
> one successfull DistributionPoint is enough?
> 
> RFC states explicitly that such GenerlName's are equivalent. 
> However RFC does not say anything about multiple 
> DistributionPoint's each having only one GeneralName.
> 
> I think that multiple DistributionPoint's are designed for 
> collection of incomplete CRLs, thus application should check 
> all of them. However there is no clarification in given RFC.
> 
> And to get sharper edge, what's desired behaviour when all 
> DistributionPoint's have no reasons flag? I think there is no 
> way how to signal to appliaction the CRLs are partitioned on 
> some internal organisation reasons (e.g. one CRL for CA 
> certificates only, another CRL for end user not-CA 
> certficates), thus appliaction should check all of them.
>

---

From: Petr Pisar <[email-masked]>
Date: Mon, 5 Oct 2009 20:22:59 +0200

> generally are all the reason codes).
Yes, that says the section 6.3.3 CRL Processing of the RFC exactly. So the
only case I still does not understand is case described in section 5 CRL and
CRL Extensions Profile:

For example, the scope could be […] or could be a set of certificates based on
arbitrary local information, such as "all certificates issued to the NIST
employees located in Boulder".

There is no specified way how to express similar criterion in the certificate
DP. Thus I thought that one need to check all DPs. Or should such case be
covered by "private extensions to carry information unique to those
communities" as written in 5.2 CRL Extensions? But it still needs to fetch all
DPs because it concerns extension of CRL, it can not been determined from
certificate DP list.

-- Petr

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 5 Oct 2009 14:27:58 -0400

Petr,

The relying party does not need to understand how the CA partitions the
CRLs.  CA can also change the partitioning scheme mid stream.

When you have a certificate and fetch a CRL, if the CRL does not have
IDP it is a full CRL.  If the IDP does not have DP, then the CRL is only
partitioned based on reason code and/or entity type.  Once you match DP
in CRL DP and DP in IDP you know for sure you have the correct segment.
Since both the certificate and CRL are signed, there can not be any
spoofing.  A description more detailed than 3280/5280 is in Annex B of
X.509, which BTW is a normative Annex.  

> Sent: Monday, October 05, 2009 2:23 PM
> To: [email-masked]
> Subject: Re: [pkix] How to handle sequence of distributionPoint's
> 
> > should not do that.  But, if you do, you need to get all the 
> > partitions whose reasons codes are of interest to the relying party 
> > (those generally are all the reason codes).
> > 
> Yes, that says the section 6.3.3 CRL Processing of the RFC 
> exactly. So the only case I still does not understand is case 
> described in section 5 CRL and CRL Extensions Profile:
> 
> For example, the scope could be [...] or could be a set of 
> certificates based on arbitrary local information, such as 
> "all certificates issued to the NIST employees located in Boulder".
> 
> There is no specified way how to express similar criterion in 
> the certificate DP. Thus I thought that one need to check all 
> DPs. Or should such case be covered by "private extensions to 
> carry information unique to those communities" as written in 
> 5.2 CRL Extensions? But it still needs to fetch all DPs 
> because it concerns extension of CRL, it can not been 
> determined from certificate DP list.
> 
> -- Petr
> 
>

---

From: "David A. Cooper" <[email-masked]>
Date: Mon, 05 Oct 2009 14:47:38 -0400

The case that you ask about does not require the use of private
extensions and would not require fetching all DPs.

Suppose that NIST wished to issue two CRLs to cover certificates issued
by a single CA:  one to cover employees located in Boulder and another
to cover employees located in Gaithersburg.  The CA could issue two
CRLs, each including an issuingDistributionPoint extension.  The
DistributionPointName in the IDP extension of one CRL would be "cn=B,
dc=nist, dc=gov" and the DistributionPointName in the IDP extension of
the other CRL would be "cn=G, dc=nist, dc=gov".  Then all certificates
issued by the CA to employees located in Boulder would include a
cRLDistributionPoints extension with a DP that had
DistributionPointName of "cn=B, dc=nist, dc=gov" and all certificates
issued by the CA to employees located in Gaithersburg would include a
cRLDistributionPoints extension with a DP that had
DistributionPointName of "cn=G, dc=nist, dc=gov".

By including an issuingDistributionPoint extension with a
DistributionPointName of "cn=B, dc=nist, dc=gov", the CRL indicates
that its scope is limited to certificates that include a
cRLDistributionPoints extension with this same DistributionPointName.
One cannot tell by looking at the CRL what the scope is (e.g., all
certificates issued to NIST employees located in Boulder, the first
1000 certificates issued by the CA, certificates issued in an odd
numbered month, etc.), but one can tell based on the contents of a
certificate's cRLDistributionPoints extension whether that particular
certificate is within the scope of the CRL (ignoring for the moment the
onlyContainsUserCerts and onlyContainsCACerts fields in the CRL's
issuingDistributionPoint extension).

Note that this means that the certificates issued to employees located
in Boulder would not include a DP that pointed to the CRL that only
covered employees located in Gaithersburg and vice versa.  If a CRL
does not provide any information about the status of a certificate,
then that CRL should not be referenced in the cRLDistributionPoints
extension of that certificate.

Dave

Petr Pisar wrote:

-- Petr

---

From: Petr Pisar <[email-masked]>
Date: Mon, 5 Oct 2009 21:12:54 +0200

On Mon, Oct 05, 2009 at 02:47:38PM -0400, David A. Cooper wrote:
> Note that this means that the certificates issued to employees located in
> Boulder would not include a DP that pointed to the CRL that only covered
> employees located in Gaithersburg and vice versa.  If a CRL does not provide
> any information about the status of a certificate, then that CRL should not
> be referenced in the cRLDistributionPoints extension of that certificate.

Thank (all of) you very much for explanation. I can see now that DP/CRL is
specific to certificate and not to CA. The specification makes sense now.

-- Petr