Subject: What is the meaning of the "indirectCRL" flag

From: "Christopher Williams" <[email-masked]>
Date: Thu, 25 May 2000 13:56:38 +0100

RFC2459, section 5.2.5  "Issuing Distribution Point" mentions an indirectCRL
flag, but does not give its significance.  Does anybody know?

Christopher Williams

Software engineer, NetLexis Ltd.
Solutions for secure electronic commerce
http://www.netlexis.com

---

From: Al Arsenault <[email-masked]>
Date: Thu, 25 May 2000 09:29:47 -0400

Christopher:

	An "indirect CRL" is a CRL issued by an entity other than the one that
issued the certificate(s) on the CRL. The relevance of this flag is
mostly explained in section 5.3.4, namely

5.3.4  Certificate Issuer

   This CRL entry extension identifies the certificate issuer associated
   with an entry in an indirect CRL, i.e. a CRL that has the indirectCRL
   indicator set in its issuing distribution point extension. If this
   extension is not present on the first entry in an indirect CRL, the
   certificate issuer defaults to the CRL issuer. On subsequent entries
   in an indirect CRL, if this extension is not present, the certificate
   issuer for the entry is the same as that for the preceding entry.

That is, the indirectCRL flag is used in combination with the
Certificate Issuer Extension to let you know that the issuer of the
certs in a CRL was different from the issuer of the CRL, and who it was.

(Normally, only the entity that issued the certificate is allowed to
revoke it; otherwise, you open yourself up to a nice denial of service
attack.  However, if you control it properly, this can be a nice
revocation management feature.)

		Al Arsenault
		Chief Security Architect
		Diversinet Corp.