Subject: Processing CRLs without Issuing Distribution Points

From: Sean Mullan <[email-masked]>
Date: Fri, 15 Oct 1999 11:21:01 -0400

RFC 2459 does not require that CRLs contain an Issuing
Distribution Point extension.

Does this mean that a CA may issue *partial* CRLs without
including an Issuing Distribution Point Extension?

If the answer is yes, it is not possible for a relying party to 
safely determine if a certificate has not been revoked by inspecting
a CRL without an Issuing Distribution Point extension. It cannot
assume that a single CRL is an exhaustive list and it also cannot
assume a sequence of CRLs when taken as one is an exhaustive list.
Therefore a relying party cannot safely determine that the certificate in 
question has not been revoked.

RFC 2587 (LDAP v2 schema) states that CAs may choose to store partial 
CRLs containing revoked CA certs only in the authorityRevocationList 
attribute, but makes no mention as to whether or not those CRLs should 
contain an Issuing Distribution Point extension. We claim they must in 
order for a relying party to be sure that the CRL is a partial CRL 
containing an exhaustive list of revoked CA certs only.

Have there been any partial CRLs deployed w/o Issuing Distribution
Point extensions?

We think that RFC 2459 should be changed (or made more clear) to make 
the Issuing Distribution Point extension mandatory for CAs which split CRLs
according to reason codes or user/CA type, and that relying parties
should treat CRLs without an Issuing Distribution Point
extension as complete (exhaustive) CRLs.

-- 
Sean Mullan			Email: [email-masked]
Sun Microsystems Laboratories	Tel:   (781) 442-0926	
One Network Drive		Fax:   (781) 442-1692
Burlington, MA 01803-0902

---

From: [email-masked]
Date: Fri, 15 Oct 1999 20:16:43 +0400

<color><param>0100,0100,0100</param>On 15 Oct 99, at 11:21, Sean Mullan wrote:

<color><param>7F00,0000,0000</param>> 

> including an Issuing Distribution Point Extension?

</color>How I understand, if CRL doesn't contain IDP, that means the CRL

is complete.

X.509 (08/97):

"<color><param>0100,0100,0100</param><FontFamily><param>Times New Roman</param>The particular CA responsible for each entry is as indicated by the certificate 

issuer CRL entry extension in that entry or in accordance with the defaulting

rules described in 12.6.3.2. In such a CRL, it is the responsibility of the CRL 

issuer to ensure that the CRL is complete in that it contains all revocation entries, 

consistent with <bold><smaller>onlyContainsUserCerts</bold><bigger>, <bold><smaller>onlyContainsCACerts</bold><bigger>, and <bold><smaller>onlySomeReasons</bold><bigger> 

indicators, from all CAs that identify this CRL issuer in their certificates."

<smaller>So, the content of CRL is on CRL issuer responsibility.</color><FontFamily><param>Arial CYR</param><bigger>

<color><param>7F00,0000,0000</param>> 

> extension as complete (exhaustive) CRLs.

</color>I think, you don't have another choices in the case, when you have

CRL with full reasons ( or without IDP at all ).

<color><param>7F00,0000,0000</param>> 

<nofill>
____________
Pavel Krylov