Subject: RE: Need verification of Issuing DP against CRL DP in son-of-2459

From: Santosh Chokhani <[email-masked]>
Date: Mon, 27 Mar 2000 07:37:46 -0500

May be in stead of these band aid type solutions, son-of-2459 authors should
adopt or synopsize the cogent material from Annex B of the current X.509
draft.  By the way, that Annex is normative.

-----Original Message-----
From: Russ Housley [mailto:[email-masked]]
Sent: Sunday, March 26, 2000 11:57 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: Need verification of Issuing DP against CRL DP in
son-of-2459

Tom:

You are correct.  Thanks for catching this omission.

We need to say that the Certificate CRLDP DistributionPointName must match 
the CRL IDP DistributionPointName, if both are preaent.

Russ

At 04:29 PM 03/23/2000 -0500, [email-masked] wrote:
>      There does not appear to be any specification in the CRL Processing
>section that the IssuingDistributionPoint extension be verified against the
>CRL Distribution Point extension.  This leaves the possibility that a
>malicious systems administrator could switch the contents of two
>distribution points with different names signed by the same CA, causing all
>revocations within those CRL's not to be found.
>      To close this hole, I would recommend rewording step (1) of section
>6.3.3 as follows: "Locate those CRL's whose IssuingDistributionPoint
>extension contain a distributionPoint matching that in the CRL Distribution
>Point and an onlySomeReasons flag value which is a subset of the reasons
>field in the CRL Distribution Point, and perform the following
>verifications:".  Furthermore, we might want to add notes that an LDAP URI
>in RFC 2255 format may be considered to match a DN if and only if the URI's
>DN field matches the DN, that missing distributionPoint names match other
>missing names, and that a missing reasons field is interpreted as
>all-reasons for the purposes of the subset calculation above.
>      There is also no statement in the current version about how the CRL
>cache is to be populated.  In my suggested version above, I have removed
>references to it.  In practice, the verifier is probably supposed to locate
>the CRL either in the CRL cache, by resolving the URI of a URI distribution
>point, by LDAP or X.500 access to the directory entry of the DN of a DN
>distribution point, or by LDAP or X.500 access to the issuer's directory
>entry for a missing distribution point or one with no name component; while
>a CRL located by any of the other methods may be added to the CRL cache.
>
>           Tom Gindin

---

From: [email-masked]
Date: Mon, 27 Mar 2000 11:20:05 -0500

You are right that annex B (which can be found in the Certificate
Extensions DAM) covers this area.  For example, section B.5.1.4 in the
Certificate Extensions DAM includes pretty nearly all of the points I made,
except for the suggested rule about matching LDAP URI's to DN's.  Section
B.4 of the DAM on obtaining CRL's might well profit by being more
thoroughly worked out, by comparison.
     The DAM does not seem to be available at present on Bull's FTP site.

          Tom Gindin

Santosh Chokhani <[email-masked]> on 03/27/2000 07:37:46 AM

To:   "'Russ Housley'" <[email-masked]>, Tom Gindin/Watson/IBM@IBMUS
cc:   [email-masked]
Subject:  RE: Need verification of Issuing DP against CRL DP in son-of-2459

May be in stead of these band aid type solutions, son-of-2459 authors
should
adopt or synopsize the cogent material from Annex B of the current X.509
draft.  By the way, that Annex is normative.

-----Original Message-----
From: Russ Housley [mailto:[email-masked]]
Sent: Sunday, March 26, 2000 11:57 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: Need verification of Issuing DP against CRL DP in
son-of-2459

Tom:

Russ