Subject: Need verification of Issuing DP against CRL DP in son-of-2459

From: [email-masked]
Date: Thu, 23 Mar 2000 16:29:49 -0500

There does not appear to be any specification in the CRL Processing
section that the IssuingDistributionPoint extension be verified against the
CRL Distribution Point extension.  This leaves the possibility that a
malicious systems administrator could switch the contents of two
distribution points with different names signed by the same CA, causing all
revocations within those CRL's not to be found.
     To close this hole, I would recommend rewording step (1) of section
6.3.3 as follows: "Locate those CRL's whose IssuingDistributionPoint
extension contain a distributionPoint matching that in the CRL Distribution
Point and an onlySomeReasons flag value which is a subset of the reasons
field in the CRL Distribution Point, and perform the following
verifications:".  Furthermore, we might want to add notes that an LDAP URI
in RFC 2255 format may be considered to match a DN if and only if the URI's
DN field matches the DN, that missing distributionPoint names match other
missing names, and that a missing reasons field is interpreted as
all-reasons for the purposes of the subset calculation above.
     There is also no statement in the current version about how the CRL
cache is to be populated.  In my suggested version above, I have removed
references to it.  In practice, the verifier is probably supposed to locate
the CRL either in the CRL cache, by resolving the URI of a URI distribution
point, by LDAP or X.500 access to the directory entry of the DN of a DN
distribution point, or by LDAP or X.500 access to the issuer's directory
entry for a missing distribution point or one with no name component; while
a CRL located by any of the other methods may be added to the CRL cache.

          Tom Gindin

---

From: Russ Housley <[email-masked]>
Date: Sun, 26 Mar 2000 23:57:14 -0500

Tom:

You are correct.  Thanks for catching this omission.

We need to say that the Certificate CRLDP DistributionPointName must match 
the CRL IDP DistributionPointName, if both are preaent.

Russ