Subject: RE: Usage of CRL Issuing Distribution Point

From: Trevor Freeman <[email-masked]>
Date: Mon, 15 Feb 1999 10:56:31 -0800

Alex,
While I agree it is not the intent of the standard to exclude future
development and future work may well do as you suggest. As of today with
RFC2459, bottom line is still that the documented extensions cannot do as
you suggest.  

-----Original Message-----
From: Alex Deacon [mailto:[email-masked]]
Sent: Friday, February 12, 1999 2:24 PM
To: Trevor Freeman
Cc: [email-masked]'
Subject: RE: Usage of CRL Issuing Distribution Point

From reading the docs, I don't get the impression that CDP and IDP
explicitly exclude the use other attributes.  I take this to (implicitly)
imply that other attributes CAN be used to partition CRL's. Is this to big
of a leap of faith to make? 

Partitioning a CRL by serialNumber sounds very reasonable to me.  So does
partitioning a CRL by some extension value which may be present in all certs
issued by a particular CA.  Why not partition a CRL by using the notBefore
validity date on the cert?  Or, perhaps the CA keeps an internal counter and
creates a new partition for every 20 certs it issues.  In an extreme case,
you may want each cert to have it own CRL partition.

If CDP's and IDP's are being used properly, (i.e. they are present in all
certs and CRL's issued by a CA) then what difference does it make as to how
the partitions were created?  

Alex

> -----Original Message-----
> From: Trevor Freeman [mailto:[email-masked]]
> Sent: Friday, February 12, 1999 12:47 PM
> To: 'Alex Deacon'
> Cc: [email-masked]'
> Subject: RE: Usage of CRL Issuing Distribution Point
> 
> 
> What extensions in these documents provide for other 
> attributes to be used
> to partition CRLs? 
> -----Original Message-----
> From: Alex Deacon [mailto:[email-masked]]
> Sent: Friday, February 12, 1999 12:40 PM
> To: Trevor Freeman
> Cc: [email-masked]'
> Subject: RE: Usage of CRL Issuing Distribution Point
> 
> 
> Trevor, 
> 
> Could you specify what document states that it is not 
> permitted for CRL's to
> be partitioned on the basis of other attributes such as 
> serial number?  I
> cant recall ever seeing such a statement in either PKIX Part 
> 1 or X.509.
> 
> Thanks
> Alex
>

---

From: Moshe Litvin <[email-masked]>
Date: Tue, 16 Feb 1999 09:28:59 +0200

Trevor,

A CA can divide the certificate to CRL without telling anyone about the reason
for the division. All it should do it put in the CDB the name (location) of the
CRL, and issue an appropriate CRL with the corresponding IDP.

It can even divide the certificate to CRLs according to the third letter of the
CN. The relying party doesn't have to know or care why it divided it that way.
All that important is that it has a way to retrieve the CRL  (the
DistributionPointName attribute), and when it got it to verify that it
correspond to the certificate (by comparing the IDP).

Moshe

--
-----------------------------------------------------------------------
Moshe Litvin                    Check Point Software Technologies Ltd.

[email-masked]            Tel:   +972-3-753-4601 (972-3-753-4555)
                                Fax:   +972-3-575-9256
-----------------------------------------------------------------------

---

From: Stephen Kent <[email-masked]>
Date: Tue, 16 Feb 1999 10:46:05 -0500

Trevor,

I am puzzled by your statements. It is true that CRLs have some facilities
to explicitly mark which classes of certs may be contrained in them, e.g.,
only CA certs or only some revocation reason codes.  However, there is no
prohibition
against round robin assignment of certs to different CRLs through the use
of the CRL distribution point extension.  In fact, that would seem to be a
major feature of this extension.  Perhaps you are raising the question of
how one ought to note, in the CRL itself, that only a subset of certs
(e.g., partiitioned by serial number) are contained in a given CRL.

Steve