Subject: Re: Vagueness in empty CRLs

From: "David P. Kemp" <[email-masked]>
Date: Tue, 4 Jan 2000 13:40:30 -0500 (EST)

It should also be clearer in X.509-Y2K.  Perhaps the definition of
revokedCertificates in CertificateList could be changed from:

    revokedCertificates ::= SEQUENCE OF SEQUENCE {
        serialNumber        CertificateSerialNumber,
        revocationDate      Time,
        crlEntryExtensions  Extensions OPTIONAL } OPTIONAL,
    ...

to:

    revokedCertificates ::= SEQUENCE SIZE(1..MAX) OF CrlEntry OPTIONAL,
    ...

    CrlEntry ::= SEQUENCE {
        serialNumber        CertificateSerialNumber,
        revocationDate      Time,
        crlEntryExtensions  Extensions OPTIONAL }

I notice that the size constraint for Extensions is present in RFC 2459
but not in X.509, so updating X.509 is not a strict prerequisite.  Still,
it would be nice if X.509 were clarified.

Dave

> Date: Tue, 04 Jan 2000 11:56:00 -0500
> To: Paul Hoffman / IMC <[email-masked]>
> From: Russ Housley <[email-masked]>
> Subject: Re: Vagueness in empty CRLs
> Cc: [email-masked]
> 
> I wrote this sentence.  I meant (a).  If you think it is necessary, we can 
> add a few words to remove the ambiguity in the next version.
> 
> Russ
> 
> 
> At 04:56 PM 01/03/2000 -0800, Paul Hoffman / IMC wrote:
> >RFC 2459, section 5.1.2 says:
> >
> >    Optional fields include lists of revoked certificates and CRL
> >    extensions.  The revoked certificate list is optional to support the
> >    case where a CA has not revoked any unexpired certificates that it
> >    has issued.
> >
> >This could be read two ways:
> >
> >a) If there are no revoked certs, do not include the optional field
> >
> >b) If there are no revoked certs, you can include and empty optional field 
> >because it is, after all, optional
> >
> >At least one developer has coded only for (a). Do people have a strong 
> >feeling one way or another? Either way, I think this should be clearer in 
> >2459bis.
> >
> >--Paul Hoffman, Director
> >--Internet Mail Consortium
>

---

From: Olivier DUBUISSON <[email-masked]>
Date: Wed, 05 Jan 2000 08:21:52 +0100

>     revokedCertificates ::= SEQUENCE SIZE(1..MAX) OF CrlEntry OPTIONAL,

A minor point: this should read:
  .......
  revokedCertificates SEQUENCE SIZE(1..MAX) OF CrlEntry OPTIONAL,
  .......
because "revokedCertificates" is a component defined in a SEQUENCE
type and not a type assignment (in which case it should begin with an
upper-case letter).

Another minor point: it is better not to used "..." to mean "etc"
inside SEQUENCE types because "..." could be interpreted as an
extension marker ;-)

Happy new year.
-- 
Olivier DUBUISSON
                       France Telecom - Branche Developpement
   _/_/_/_/       Centre National d'Etudes des Telecommunications
  _/_/_/_/     DTL/MSV - Piece WF025 - 22307 Lannion Cedex - France
 _/_/_/_/         tel: +33 2 96 05 38 50 - fax: +33 2 96 05 39 45
                   --> Site ASN.1 : http://asn1.elibel.tm.fr/ <--