Subject: Re: CRL version field confusion

From: [email-masked]
Date: Tue, 23 Mar 1999 12:19:33 -0500

In my opinion, the best way to deal with this would be to allow both
options, by modifying both X.509 (1997) section 11.2 Note 3 and RFC 2459
section 5.1.2.1 as follows:

X.509 note:    Replace the second sentence of this note (If no extensions
defined as critical are included, the version element shall be absent.) by:
If no extensions are included, the version element shall be absent.  If
non-critical extensions are present, but no critical extensions are
present, the version number should be absent but it shall be accepted if
present.

RFC 2459 section:  Replace the second sentence of this section (When
extensions are used, as required by this profile, this field MUST be
present and MUST specify version 2 (the integer value is 1).) by: When
critical extensions are present, this field MUST be present and MUST
specify version 2 (the integer value is 1).  In all other cases of CRL's
conforming to this profile, this field SHOULD be present and, if present,
MUST specify version 2.

     These two amendments would allow conforming implementations of each
standard to work with each other.

          Tom Gindin

Martin Lindström <[email-masked]> on 03/23/99 10:14:20 AM

To:   [email-masked]
cc:    (bcc: Tom Gindin/Watson/IBM)
Subject:  Re: CRL version field confusion

Regarding the issue with the slightly different approaches of
coding the CRL version field.

"Both sides" have now stated an explanation of why/why not the
CRL version field should be present in a CRL containing only
non-critical extensions.
However, the fact remains that a CA following X.509 may be
imcompatible with a client processing CRLs according to rfc2459.
This is of course not desirable in any way and I'm a bit surprised
that no effort in resolving the ambiguity was made.

Clearly, rfc2459 should be compatible with X.509, or?

Comments?

Regards Martin Lindström

______________________________________
         Entegrity Solutions

  Martin Lindström
  Senior Systems Engineer

  Finlandsgatan 60
  S-164 74 Kista, Sweden
  Direct: +46-(0)8-477-7735
  Fax:    +46-(0)8-477-7731
  Cell:   +46-(0)70-483-0024
______________________________________