Subject: RE: 3280bis: a few fixes for CRL validation

From: "Stefan Santesson" <[email-masked]>
Date: Tue, 21 Jun 2005 15:22:10 +0100

Peter,

I think the first change is OK but not the second.

I think this discussion has shown that "CRL issuer" is a role.

/Stefan

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> On Behalf Of Peter Sylvester
> Sent: den 21 juni 2005 12:57
> To: David A. Cooper; [email-masked]
> Subject: Re: 3280bis: a few fixes for CRL validation
> 
> 
> >>
> >>
> >> FIX n°1. In section 4.2.1.14 CRL Distribution Points
> >>
> >> Change:
> >>
> >> If the certificate issuer is not the CRL
> >> issuer, then the cRLIssuer field MUST be present and contain the Name
> >> of the CRL issuer.
> >>
> >> into:
> >>
> >> If the certificate issuer is not *also* the CRL issuer, then the
> >> cRLIssuer field MUST be present and contain the Name of the CRL issuer.
> >
> It seems to me that one confusion may come from the text in 3280 saying
> that a CA can delegate CRL issuance to another 'SYSTEM'. Then the text
> 'cert issuer is not the crl issuer' may be unclear. It seems to me that
> by adding the word 'entity' the confusion can be avoided:
> 
> 'If the certificate issuer entity is not the CRL issuer entity, in order
> to
> indicate the different name, the cRLissuer field must be present and
> contain the Name of the CRL issuer entity.'

---

From: "Julien Stern" <[email-masked]>
Date: Tue, 21 Jun 2005 16:42:10 +0200

> I think this discussion has shown that "CRL issuer" is a role.

Regarding change #1:
The problem is: what exactly does it mean to "also [be] the CRL issuer" ?

1) To have the same DN and to use exactly the same key ?
2) To have the same DN (and possibly use different keys) ?

In the second case, we fall back on the heated discussions
related to DN uniqueness...

--
Julien

---

From: Peter Sylvester <[email-masked]>
Date: Tue, 21 Jun 2005 18:20:44 +0200

Stefan and Julien:

Just to be sure: I should have left the indication that the
Fix n 1 came from Denis, not from me. Soirry for the
confusion.

I think you both refered to Denis text.

MY suggestion is to essentially add the word entity at two places.

"If the certificate issuer entity is not the CRL issuer entity, in order to
indicate the different name, the cRLissuer field must be present and
contain the Name of the CRL issuer entity."

-- 
To verify the signature, see http://edelpki.edelweb.fr/ 
Cela vous permet de charger le certificat de l'autorité; 
die Liste mit zurückgerufenen Zertifikaten finden Sie da auch.