Subject: Re: 3280bis: a few fixes for CRL validation

From: "Denis Pinkas" <[email-masked]>
Date: Mon, 20 Jun 2005 18:48:01 +0100

David,

(text deleted)

>This should be very simple.

>If an entity issues certificates, then it is a CA.

>If an entity issues CRLs, then it is a CRL issuer.

>An entity may (1) issue both certificates and CRLs; (2) issue 
>certificates but not CRLs; or (3) issue CRLs but not certificates.

>How difficult is that?  If an entity issues CRLs, then it is a CRL 
>issuer.  If that same entity also happens to issue certificates, then it 
>is both a CA and a CRL issuer and we have an instance of a certificate 
>issuer that is also a CRL issuer.

We now strongly agree.

(text deleted)

>I have no interest in discussing this topic any further.  This is an 
>issue that has been discussed several times over the past couple of 
>years and there is no reason to have the same discussions over and over 
>again, especially when topic at hand, the precise meaning of some term, 
>has no real effect on the standard.

Since you now agree that a CRL issuer does not issue certificates, 
there is a need to fix the text in several places where this assumption 
was made :

FIX n°1. In section 4.2.1.14  CRL Distribution Points

Change:

                                If the certificate issuer is not the CRL
   issuer, then the cRLIssuer field MUST be present and contain the Name
   of the CRL issuer. 

into: 

   If the certificate issuer is not *also* the CRL issuer, then the 
   cRLIssuer field MUST be present and contain the Name of the CRL issuer. 

FIX n°2. In section 5.2.5  Issuing Distribution Point

Change:

   If the distributionPoint field is absent, the CRL MUST contain
   entries for all revoked unexpired certificates issued by the CRL
   issuer, if any, within the scope of the CRL. 

into:

   If the distributionPoint field is absent, the CRL MUST contain
   entries for all revoked unexpired certificates, if any, issued by 
   the CA that delegated the publication of the CRL, within the scope 
   of the CRL. 

FIX n°3. In section 5.2.5  Issuing Distribution Point

Change:

   The CRL issuer MUST assert the indirectCRL boolean, if the scope of
   the CRL includes certificates issued by authorities other than the
   CRL issuer.

into:

   The CRL issuer MUST assert the indirectCRL boolean, if the scope of
   the CRL includes entries for certificates issued by more than one CA. 

FIX n°4. In section 5.3.4  Certificate Issuer

Change:

   If this extension is not present on the first entry in an
   indirect CRL, the certificate issuer defaults to the CRL issuer. 

into:

   If this extension is not present on the first entry in a CRL, 
   then the CRL includes entries for certificates issued by a 
   single CA. 

FIX n°5. This last change proposal is not directly related to the 
vocabulary issue, but was noticed while re-reading section 
5.3.4  Certificate Issuer

Change:

   If an implementation ignored this extension it could not
   correctly attribute CRL entries to certificates.  This specification
   RECOMMENDS that implementations recognize this extension. 

into:

   A implementation SHALL reject the CRL, if this extension is 
   encountered and is not recognized. 

Rational: This is the normal behaviour for critical extensions.

Denis

>Dave

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 20 Jun 2005 18:29:11 +0100

Denis,

For an English native speaker that makes very little sense.

>>...  If that same entity also happens to issue certificates, then it

You seem to be agreeing there that a CRL issuer can issue certs.

Alice is a CA.
Alice is a CRL issuer.
Alice is a CA => Alice issues certs

...drum roll...therefore..

Alice is a CRL issuer && Alice issues certs

[...]
> Since you now agree that a CRL issuer does not issue certificates, 

Huh? What about Alice?

Stephen.

---

From: "David A. Cooper" <[email-masked]>
Date: Mon, 20 Jun 2005 15:58:46 -0400

Denis,

First, I never said that a CRL issuer does not issue certificates.  I 
would never say that.  Any entity that issues CRLs is a CRL issuer.  A 
CRL issuer may or may not issue certificates.  In most cases, a CRL 
issuer will issue certificates.  That is, in most cases, a CA will issue 
CRLs that cover its own certificates.  Since this entity issues CRLs, it 
is a CRL issuer.  Since it also issues certificates, it is a CRL issuer 
that issues certificates.

Many of the so called "fixes" that you propose are just plain 
incorrect.  Not only that, they are based on false statements that you 
have made several times in the past.  Each time that you have made these 
false statements, people have demonstrated to you that your statements 
were incorrect.  I can only conclude at this point that you are 
continuing to make these statements despite knowing that they are 
incorrect in the hopes of deceiving people.

I am not going to respond your individual comments since they have 
already been addressed several times before.  But, I can assure you that 
we are not going to change the PKIX Certificate and CRL profile to make 
it inconsistent with X.509, no matter how many times you repeat these 
false statements.

Dave

---

From: Peter Sylvester <[email-masked]>
Date: Tue, 21 Jun 2005 12:57:08 +0200

>> cRLIssuer field MUST be present and contain the Name of the CRL issuer.
It seems to me that one confusion may come from the text in 3280 saying
that a CA can delegate CRL issuance to another 'SYSTEM'. Then the text
'cert issuer is not the crl issuer' may be unclear. It seems to me that
by adding the word 'entity' the confusion can be avoided:

'If the certificate issuer entity is not the CRL issuer entity, in order to
indicate the different name, the cRLissuer field must be present and
contain the Name of the CRL issuer entity.'

---

From: Russ Housley <[email-masked]>
Date: Tue, 21 Jun 2005 11:13:14 -0400

This text was discussed at great length.  The definition of CRL Issuer in 
section 3 sounds very simple when you read it today, but it was not the 
first set of words ...

I do not think we need to go over this again and again and again.

Russ

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 20 Jun 2005 18:29:11 +0100

Denis,

Alice is a CA.
Alice is a CRL issuer.

[...]

Huh? What about Alice?

Stephen.

---

From: Stephen Kent <[email-masked]>
Date: Fri, 24 Jun 2005 17:28:56 -0400

Denis,

I won't comment on all of your suggested woridng changes. I'm sure 
David will address them appropriately.

However, in regard to your suggested wording for the cert issuer 
extension in a CRL entry, I don't think we can reasonably make such a 
change. While it is true that one should ignore an extension in a 
cert if one does not understand it AND if it is not marked critical, 
in a CRL the logic is more complicated. This CRL entry extension MUST 
be marked critical as per 3280. There are no really good ways for an 
RP to behave if it doesn't understand how to process this extension, 
hence the recommendation that all PKIX-compliant implementations 
recognize it.

Steve