Subject: RE: ARL without IDP extension

From: Ambarish Malpani <[email-masked]>
Date: Wed, 14 Feb 2001 22:35:47 -0800

Hi,
    I would agree with you, that any CRL that didn't contain
the IDP extension *is* a full CRL. Anything else would be an
invitation to trouble.

Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
339 N. Bernardo Ave.                          http://www.valicert.com
Mountain View, CA 94043

> -----Original Message-----
> From: Hiroyuki Sakakibara [mailto:[email-masked]]
> Sent: Wednesday, February 14, 2001 10:13 PM
> To: [email-masked]
> Subject: ARL without IDP extension
> 
> 
> Hello
> 
> I have a question about the definition of ARL.
> 
> I think that the definition of ARL is
> 
> "a CRL which contains Issuing Distribution Point
>   with onlyContainAuthorityCerts = TRUE."
> 
> hence, I think the following CRL is NOT ARL.
> 
> "CRL which contains ONLY CA Certificate Revocation 
> Information on the list
> but not containts IDP"
> 
> I think this is a Complete CRL ( eventhough it contains only 
> CA Certificate
> information).
> 
> Am I right ?
> 
> -------------------------------------------------------------
> 
> If the CRL is determied as ARL, the following problem
> may occur.
> 
> * CRL1(as ARL)
> Issuer = XYZ_CA
> thisUpdate = 2001 02 14 12 00 00 Z
> nextUpdate = 2001 03 14 12 00 00 Z
> contains CA Certificate Information only
> ( Cert1 issued by XYZ_CA is revoked )
> without IDP
> 
> * CRL2
> Issuer = XYZ_CA
> thisUpdate = 2001 02 14 18 00 00 Z
> nextUpdate = 2001 03 14 18 00 00 Z
> contains EndUser Certificate Information only
> without IDP
> 
> Assume that RP check these CRLs at date = 2001 02 17 12 00 00 Z,
> RP determine that the latest CRL for a CA certificate "Cert1" 
> issued by
> XYZ_CA  is "CRL2" (for example, cross-certification environment).
> 
> But CRL2 does not contain CA Certificates information, hence RP may
> misunderstand that the certificate was valid.
> 
> OR if the definition of CRL1 is correct as ARL( because it contains
> ONLY CA Certificate Information),
> RP should check both CRL1 and CRL2 ???
> 
> I welcome any comments.
> Thank you.
> 
> --------------------------
> Hiroyuki Sakakibara
> Mitsubishi Electric Corporation
> 
>

---

From: "Hiroyuki Sakakibara" <[email-masked]>
Date: Mon, 19 Feb 2001 15:45:06 +0900

Mr. Malpani

Thank you for your comment.

Mr. Malpani> I would agree with you, that any CRL that didn't contain
Mr. Malpani> the IDP extension *is* a full CRL. Anything else would be an
Mr. Malpani> invitation to trouble.

I think that if an ARL without IDP is issued by a CA and it causes trouble,
the CA is responsible for it, not RP.

A CA may locate such ARLs in a directory system as
"authorityRevocationList"s.
If a RP trusts the directory system, the RP may use the ARL without IDP
in the directory entry as ARL, but otherwise the RP can not recognize the
entry is "ARL".

I think even though the RP trusts the Directory system by any method
( passowrd authentication or SSL etc ... ), the RP shoud check that
the ARL is "ARL" by himself,
because the RP's trust level for the directory system and the ARL's
signagture is not identical.
Hence, I think an ARL should contain an information such as IDP
which a RP can recognize the RL is  "ARL" by checking the RL it self.

Hiroyuki Sakakibara

---------------------------------------
Hiroyuki Sakakibara
MITSUBISHI ELECTRIC CORPORATION
Information Technology R&D Center
5-1-1 Ofuna, Kamakura, Kanagawa, Japan
PHONE: +81-467-41-2183
FAX:   +81-467-41-2185
E-mail : [email-masked]