Subject: Question:Authority Information Access

From: "Hiroyuki Sakakibara" <[email-masked]>
Date: Wed, 24 Nov 1999 12:01:31 +0900

Hello

I have questions about RFC2459 Authority Information Access extension .
In RFC2459, this extension is defined as

"The authority information access extension indicates how to access CA
   information and services for the issuer of the certificate in which
   the extension appears. Information and services may include on-line
   validation services and CA policy data.  (The location of CRLs is not
   specified in this extension; that information is provided by the
   cRLDistributionPoints extension.)  This extension may be included in
   subject or CA certificates, and it MUST be non-critical." ...

Question 1.
If a certificate path verification function of a secure application
finds a certificate which includes BOTH Authority Information Access(AIA)
extension and CRL DP extension,
which extension will the function use ?

Question 2.
I assume the following situations "case1, case2, case3".
I think that case1 and case2 are OK.
But, how about case3 ?
In example2, I think that AIA and CRL DPs are not available ...
I think that "priority" descriptions are needed in somewhere ... ???

*****************************************
case 1: 
In this case, the application policy is 
"at first, a certificate is checked by OCSP server-1.
If OCSP server-1 is not available, then it will be checked by
OCSP server-2."

1st.       OCSP server-1 
2nd.      OCSP server-2

-> use AIA extension only.

case 2: 
In this case, the application policy is 
"at first, a certificate is checked by CRL DP-1. 
If CRL DP-1 is not available, then it will be checked by
CRL DP-2."

1st.       CRL DP-1
2nd.      CRL DP-2

-> use CRL DPs extension only 

case 3:
 In this case, the application policy is 
"a certificate is checked by OCSP servers and CRL DPs.

example1

1st.       OCSP server-1
2nd.      OCSP server-2 
3rd.      CRL DP-1
4th.      CRL DP-2

example2

1st.        OCSP server-1
2nd.       CRL DP-1
3rd.       OCSP server-2
4th.       CRL DP-2

etc ...

*****************************************

=========================================
Hiroyuki Sakakibara
Research Engineer
Information Security Department
Mitsubishi Electric Corporation
Information Technology R&D Center
5-1-1 Ofuna, Kamakura, Kanagawa, 247-8501, Japan
PHONE: +81-467-41-2183
FAX: +81-467-41-2185
==========================================

---

From: "Khaja E. Ahmed" <[email-masked]>
Date: Tue, 23 Nov 1999 19:36:47 -0800

All the burden you are placing on the client to check multiple places should
really not be necessary.  It should be possible for the client to go to a
single location indicated by either the DP or the AIA extension and *depend*
on it being there just as much as you depends on the availability of the
network itself.  Revocation status checking service should have the same
availability / dependability of something like DNS.  If you suddenly lose
access to DNS service you have lost access to a mission critical service and
are essentially "down" or severely hobbled in your functionality.  That is
why DNS service is designed to be highly available and dependable.

That degree of dependability and availability is precisely what you should
expect of your PKI / Validation service/product provider.  This is very
doable and these solutions are COTS and today.

Khaja

> -----Original Message-----
> From: Hiroyuki Sakakibara [mailto:[email-masked]]
> Sent: Tuesday, November 23, 1999 7:02 PM
> To: [email-masked]
> Subject: Question:Authority Information Access
>
>
> Hello
>