Subject: CRL version field confusion

From: Martin Lindström <[email-masked]>
Date: Thu, 18 Mar 1999 09:47:56 +0100

I think I've found an ambiguity(?) between rfc2459 and the X.509
in the way CRL version fields should be treated.

X.509 says: "If any extensions included in a CertificateList are
defined as critical, the version element of the CertificateList
shall be present. If no extensions defined as critical are included,
the version element shall be absent"

RFC2459 on the other hand says: "When extensions are used, as required
by this profile, this field MUST be present and MUST specify version 2"

Depending on which definition I use to encode a CRL having no critical
extensions I get different results. Is this correct?

/Martin

______________________________________
         Entegrity Solutions

  Martin Lindström
  Senior Systems Engineer 

  Finlandsgatan 60 
  S-164 74 Kista, Sweden
  Direct: +46-(0)8-477-7735
  Fax:    +46-(0)8-477-7731
  Cell:   +46-(0)70-483-0024
______________________________________

---

From: Stephen Kent <[email-masked]>
Date: Thu, 18 Mar 1999 11:05:48 -0500

Martin,

>extensions I get different results. Is this correct?

I feel that RFC 2459 is correct. Even if an extension is not marked
critical, a client that does not understand V2 CRLs might crash trying to
parse a v2 CRL with ANY extensions.

---

From: "Ambarish Malpani" <[email-masked]>
Date: Thu, 18 Mar 1999 10:20:52 -0800

Actually it isn't an ambiguity. The default value for the version
in CRLs, is v1 (i.e. 0). So if you are encoding a version 1
CRL (ie. one with no extensions), you don't encode the version
number.

Hope this helps,
Regards,
Ambarish

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf
Of Martin Lindström
Sent: Thursday, March 18, 1999 12:48 AM
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: CRL version field confusion

/Martin

  Martin Lindström
  Senior Systems Engineer

  Finlandsgatan 60
  S-164 74 Kista, Sweden

---

From: Srinivas Pandrangi <[email-masked]>
Date: Thu, 18 Mar 1999 12:56:58 -0800

Ambarish,
X.509 does seem to say that version should be v1(0) if non-critical
crlExtensions are present. It suggests that only crlEntryExtensions (in
revokedCertificates), and "critical" crlExtensions imply a version of v2.
This is in contrast to PKIX which says that the presence of any extension
implies v2.
--Srinivas

--
-------------------------------------------------------------------
Srinivas Pandrangi
XETI Inc.
[email-masked]
(650) 694 6804
-------------------------------------------------------------------

---

From: "David Chadwick" <[email-masked]>
Date: Thu, 18 Mar 1999 23:05:52 -0000

> >shall be present. If no extensions defined as critical are included, the
> >version element shall be absent"
> >
> >RFC2459 on the other hand says: "When extensions are used, as required by
> >this profile, this field MUST be present and MUST specify version 2"
> >

This should not happen. All clients should correctly support the rules 
for extensibility, which state that unknown elements in a SET or 
SEQUENCE should be skipped and ignored. Therefore there is no 
reason to crash (except for a faulty implementation)

David

***************************************************

David Chadwick
IT Institute, University of Salford, Salford M5 4WT
Tel +44 161 295 5351  Fax +44 161 745 8169
Mobile +44 370 957 287
Email [email-masked]
Home Page  http://www.salford.ac.uk/its024/chadwick.htm
Understanding X.500  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string MLJ9-DU5T-HV8J

***************************************************

---

From: Russ Housley <[email-masked]>
Date: Thu, 18 Mar 1999 09:04:29 -0500

I believe the PKIX RFC 2459 text should be followed.  Implementations will
have problems if non-critical extensions are included in version 1 CRLs.

Russ