Subject: cRLIssuer names and management domain correlation

From: "Peter Williams" <[email-masked]>
Date: Fri, 19 Feb 1999 12:17:11 -0600

Assume a user certificate contains a CRL distribution
point URI indication and names the expected/required issuer of
the CRL (fragment) in a manner conforming with RFC 2459.

Does the management/certification domain responsible
for reliably authenticating the user certificate need to
the same as that which reliably authenticates the issuer
of the CRL (fragment) to meet 2459 conformance
requirements?

For example:

A user certificate has cRLDistributionPoints extension identifying
 "c=US, o=IETF" as the required (DN-name-formed)
issuer of the CRL (fragment) for that cert.

To help authentication, multiple CAs (in 
multiple management domains) may all have
issued identity certificates for "c=US, o=IETF"
and all these domains may be registered in the
users system as equally valid/trusted sources of 
authentication information for objects received 
from a given URI.

Under 1422 rules, where it is the case that
multiple PCAs may have certifed the
nominal CA "c=US, o=IETF" which
issues CRLs, the relying party gets to choose which
management domain (PCA) controls
the validation of the CRL. Of course,
alternative trust chains, issued under the
rules of two different management domains,
may both authenticate the same identity
of "c=US, o=IETF".
 
If a given PKI management domain is relied upon
for verifying a user certificate's signature, but a second
domain is relied upon when validating the CRL ( which 
helps verify and validate the user certificate) does any 
subtle 2459 language or intended interpretation 
put any constraints on relying party systems for
this situation?

Peter.

---

From: Stephen Kent <[email-masked]>
Date: Sun, 21 Feb 1999 16:34:12 -0500

Peter,

I would assume either the default case in which the CA must have signed the
CRL, or must have issued a cert (directly) to an entity who signed the CRL
and that cert should have the keyusage restriction extsnsion set to
indicate that the key in question is to be used only for CRL signing (and I
would mark this extension critical).  In either case, it then is apparent
that the entity signing the CRL has been authorized to do so by the CA who
issued the cert with the CDP extension.

Steve