Subject: Question about updating the CA to change its DN encoding

From: Masaki SHIMAOKA <[email-masked]>
Date: Tue, 15 Feb 2005 19:38:19 +0900

Hi all,

I have one question about updating the CA to change its DN encoding.

If the old CA and new CA have different keypairs, issue the self-issued
certificates each other, and have same DN regardless of encoding, should
both CA share the revocation information between their CRLs?
# I believe that such self-issued certificates are the one called a name
rollover certificate in RFC 3280.

The reason why I wonder is that revocation information is specified by
issuer and serial number.  If an application assumes that DNs of such
old CA and new CA is the same, the application may use to check the CRL
issued by new CA for a certificate issued by old CA.  
And if the answer is YES in the case using such applications, it means
anyone can make the CRL substitution attack easily.

So, I hope the answer is NO and all applications should use to check the
CRL issued by the signing key of the corresponding certificate issuer.

Is it correct?

-- shima

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Tue, 15 Feb 2005 16:21:46 +0100

>CRL issued by the signing key of the corresponding certificate issuer.
"name rollover" certificates are needed only for client that don't 
support encoding conversions when comparing DN.
Even many clients are in this case, some clients can be correctly 
implementing the comparison and then they will handle the two 
certificates as belonging to the same CA.
If thoses clients also fully implement the CRL checking rules, then they 
should consider a CRLs emitted under either the old or the new key as 
valid for certificates emitted under both keys.

The answer is YES, even if it might be in practice difficult to find 
even one single client that is actually affected.

---

From: Masaki SHIMAOKA <[email-masked]>
Date: Wed, 16 Feb 2005 17:45:14 +0900

Jean-Marc,

> support encoding conversions when comparing DN.

Right.

> valid for certificates emitted under both keys.

Sorry, for my English problem, I could not catch correctly what you say.
I guess you mentioned that a client that implements fully the CRL
checking rules should be able to validate a certificate that is issued
by both the new key and the old key with a CRL regardless of its signing
key.

If so, I guess what to share the revocation information with the old key
and the new key means that new key MUST NOT use any serial number which
was used already by the old key.
Right?

> even one single client that is actually affected.

I agree.

-- shima

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Wed, 16 Feb 2005 11:33:22 +0100

>by both the new key and the old key with a CRL regardless of its signing
Yes.
There has been lengthly discussions on the list a few month ago about 
this point that definitively confirmed that.

>was used already by the old key.
Yes again.

The encoding change doesn't modify the rule.

It only restricts even more the set of clients that completely respect 
it, and would be endangered by reusing the serial numbers or not 
including in both CRL the serial numbers for the certs emitted by the 
old and the new key.

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Wed, 16 Feb 2005 18:46:48 +0800

Masaki,

You seem to mix up "name rollover" with "key rollover". However, these
two kinds of rollover are orthogonal. A CA performing "name rollover"
does not necessarily change its cert/CRL sining key.

Anyway, if your CA needs a migration of name encoding, do not count on
issuing a "name rollover" certificate because it won't work.
I had ever raised this as a 3280bis issue. I hope that 3280bis obsoletes
the recommendation of using "name rollover" certificates. The following is
quoted from my previous post:

  ----- Original Message ----- 
  From: "Wen-Cheng Wang" <[email-masked]>
  Sent: Wednesday, November 17, 2004 6:36 PM
  Subject: 3280bis issue: Name Rollover certificate
  
  > The current text of RFC 3280 recommend using "name rollover" certificates to
  > support an orderly migration to UTF8String encoding.
  > 
  > However, I recall that there being a number of threads discussing whether
  > the recommendation works. It was finally concluded that the recommendation
  > does not work. Therefore, shouldn't the recommendation of using "name rollover"
  > certificates be removed from son of RFC 3280.
  > 

Wen-Cheng Wang

---

From: Masaki SHIMAOKA <[email-masked]>
Date: Thu, 17 Feb 2005 00:31:08 +0900

> does not necessarily change its cert/CRL sining key.

Yes, I think basically a CA should also change its keypair when the CA
renews its certificate.  If the CA change only encoding of DN in the
certificate, changing its keypair is not necessary because it does not
affect to the strength of keypair.  But, most CA may change its validity
such as notAfter not only the encoding of its DN.  
Of course it is not a technical issue, but an operational issue.  But,
for this issue I say "basically a CA should also change its keypair".

> issuing a "name rollover" certificate because it won't work.

Okay, folks can wait an updating of 3280bis;)

-- shima