Subject: RE: CDP in self signed root CA

From: Roger Younglove <[email-masked]>
Date: Thu, 5 Dec 2002 15:01:17 -0500

Erwan,
I would agree with the agreement against. There is no authority above the
root CA to issue a CRL on it's cert as it is self signed. Each layer of CAs
below the root and the EEs have a level of authority above them to issue
CRLs that creates a path to validate for the CRLs.
 
Roger Younglove, CISSP
Principal Consultant
NetWorks Group
O. 810.225.4800 ex. 2245
M. 810.599.0879
E. [email-masked]
www.networksgroup.com
 
-----Original Message-----
From: Erwan Smits [mailto:[email-masked]] 
Sent: Thursday, December 05, 2002 11:36 AM
To: [email-masked]
Subject: CDP in self signed root CA
 
We are building a certificate hierarchy with 4 (CA) layers. We want to
include a CDP extension in every CA and end user certificate. At the moment
we have a discussion about the need for a CDP extension in the Root CA. The
argument against it is that it doesn't make sense because there is no
supperior CA that can sign the CRL. The argument for a CDP is that for
performing a correct path validation the CRL for every CA (including the
Root CA) and end-user certificate should be validated.
 
I scanned through RFC 3280, but it doesn't say anything about it. Does
anybody have suggestions?
 
Greetings,
 
Erwan Smits

---

From: Peter Gutmann <[email-masked]>
Date: Mon, 9 Dec 2002 16:35:29 +1300 (NZDT)

[Apologies if you've seen this before, one of our machines has been quietly
 dropping outgoing mail...]

"Hallam-Baker, Phillip" <[email-masked]> writes:

>A self signed CA has a signer. The fact that the signer is itself means that
>the only deduction that you can draw from the certificate is that the holder
>of the private key asserted the contents to be true at some time.
>
>If a CRL exists that revokes the self signed CA one should logically infer
>from that that the holder of the private key asserts that the contents are
>false.

I cover this amusing situation in "Everything you never wanted to know about
PKI but have been forced to find out" on my home page.  It's the PKI
equivalent of Epimenides Paradox, "All Cretans are liars".  Software reacts to
this in one of three ways:

- The CRL revokes the cert which signed it, therefore the CRL is invalid,
  therefore the cert isn't revoked.

- The CRL revokes the cert, which becomes invalid after being used to verify
  the CRL.

- The software crashes (more advanced software goes insane and starts killing
  members of the crew, one by one).

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Mon, 9 Dec 2002 16:40:33 +1300 (NZDT)

Steve Hanna <[email-masked]> writes:

>The "suicide note" concept could be used to double-check trust anchor status.
>Self-signed CRLs are a pale imitation, since a suicide note is irrevocable
>and a self-signed CRL is easily superceded by a newer one signed by the
>person who compromised the key. Also, a suicide note can be produced even if
>the key is no longer accessible to the proper key holder. Not so for a self-
>signed CRL.

This was discussed in the context of CMP a year or two back:

  That's why I argued a while back for PGP-style suicide-note revocations
  which are generated at the same time the cert is generated.  The way I see
  revocations is that they're equivalent to a scram switch on a nuclear
  reactor, you want a big red button in an easily-accessible location with a
  clear indication that if anything at all goes wrong, you hit the BRS and
  worry about the details later.  The CMP approach seems to be to make
  revocation as difficult as humanly possible (even impossible in some cases)
  because of DoS concerns, but if my reactor core is currently eating through
  the bedrock on its way to China a possible DoS is going to be the last thing
  on my mind (although I may worry a bit about excessive mixing of metaphors).
  Having to tell the insurance investigators that "Well, we couldn't revoke
  our key and got completely cleaned out, but at least we're not vulnerable to
  a DoS" really isn't going to cut it in the real world.

Unfortunately although in theory you could easily do it with a pre-generated
revocation request, CMP is designed in such a way as to make it impossible
:-(.  I've looked at doing it in response to user requests, but the only way
to do it would be a totally nonstandard protocol extension that nothing else
could work with.

Peter.