Subject: Re: 3280bis: a few fixes for CRL validation

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 21 Jun 2005 10:28:31 +0100

>Denis,

>First, I never said that a CRL issuer does not issue certificates.  I 
>would never say that.  

In that case we will never agree, and all what you say below in based on this disagreement.

This will need to be discussed at the Paris meeting. 
Are you coming ?

Denis

> Any entity that issues CRLs is a CRL issuer.  A 
>CRL issuer may or may not issue certificates.  In most cases, a CRL 
>issuer will issue certificates.  That is, in most cases, a CA will issue 
>CRLs that cover its own certificates.  Since this entity issues CRLs, it 
>is a CRL issuer.  Since it also issues certificates, it is a CRL issuer 
>that issues certificates.
>
>Many of the so called "fixes" that you propose are just plain 
>incorrect.  Not only that, they are based on false statements that you 
>have made several times in the past.  Each time that you have made these 
>false statements, people have demonstrated to you that your statements 
>were incorrect.  I can only conclude at this point that you are 
>continuing to make these statements despite knowing that they are 
>incorrect in the hopes of deceiving people.
>
>I am not going to respond your individual comments since they have 
>already been addressed several times before.  But, I can assure you that 
>we are not going to change the PKIX Certificate and CRL profile to make 
>it inconsistent with X.509, no matter how many times you repeat these 
>false statements.
>
>Dave
>
>Denis Pinkas wrote:
>
>> David,
>>
>> (text deleted)
>>
>>> This should be very simple.
>>
>>> If an entity issues certificates, then it is a CA.
>>
>>> If an entity issues CRLs, then it is a CRL issuer.
>>
>>> An entity may (1) issue both certificates and CRLs; (2) issue
>>> certificates but not CRLs; or (3) issue CRLs but not certificates.
>>
>>> How difficult is that? If an entity issues CRLs, then it is a CRL
>>> issuer. If that same entity also happens to issue certificates, then it
>>> is both a CA and a CRL issuer and we have an instance of a certificate
>>> issuer that is also a CRL issuer.
>>
>>
>> We now strongly agree.
>>
>> (text deleted)
>>
>>> I have no interest in discussing this topic any further. This is an
>>> issue that has been discussed several times over the past couple of
>>> years and there is no reason to have the same discussions over and over
>>> again, especially when topic at hand, the precise meaning of some term,
>>> has no real effect on the standard.
>>
>>
>> Since you now agree that a CRL issuer does not issue certificates,
>> there is a need to fix the text in several places where this assumption
>> was made :
>>
>> FIX n°1. In section 4.2.1.14 CRL Distribution Points
>>
>> Change:
>>
>> If the certificate issuer is not the CRL
>> issuer, then the cRLIssuer field MUST be present and contain the Name
>> of the CRL issuer.
>>
>> into:
>>
>> If the certificate issuer is not *also* the CRL issuer, then the
>> cRLIssuer field MUST be present and contain the Name of the CRL issuer.
>>
>>
>> FIX n°2. In section 5.2.5 Issuing Distribution Point
>>
>> Change:
>>
>> If the distributionPoint field is absent, the CRL MUST contain
>> entries for all revoked unexpired certificates issued by the CRL
>> issuer, if any, within the scope of the CRL.
>>
>> into:
>>
>> If the distributionPoint field is absent, the CRL MUST contain
>> entries for all revoked unexpired certificates, if any, issued by
>> the CA that delegated the publication of the CRL, within the scope
>> of the CRL.
>>
>>
>> FIX n°3. In section 5.2.5 Issuing Distribution Point
>>
>> Change:
>>
>> The CRL issuer MUST assert the indirectCRL boolean, if the scope of
>> the CRL includes certificates issued by authorities other than the
>> CRL issuer.
>>
>> into:
>>
>> The CRL issuer MUST assert the indirectCRL boolean, if the scope of
>> the CRL includes entries for certificates issued by more than one CA.
>>
>>
>> FIX n°4. In section 5.3.4 Certificate Issuer
>>
>> Change:
>>
>> If this extension is not present on the first entry in an
>> indirect CRL, the certificate issuer defaults to the CRL issuer.
>>
>> into:
>>
>> If this extension is not present on the first entry in a CRL,
>> then the CRL includes entries for certificates issued by a
>> single CA.
>>
>>
>> FIX n°5. This last change proposal is not directly related to the
>> vocabulary issue, but was noticed while re-reading section
>> 5.3.4 Certificate Issuer
>>
>> Change:
>>
>> If an implementation ignored this extension it could not
>> correctly attribute CRL entries to certificates. This specification
>> RECOMMENDS that implementations recognize this extension.
>>
>> into:
>>
>> A implementation SHALL reject the CRL, if this extension is
>> encountered and is not recognized.
>>
>> Rational: This is the normal behaviour for critical extensions.
>>
>> Denis
>>
>>> Dave
>>
>

Regards,

Denis Pinkas

---

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 21 Jun 2005 11:07:52 +0100

>For an English native speaker that makes very little sense.

For an English non-native speaker that makes sense.

>>>...  If that same entity also happens to issue certificates, then it
>You seem to be agreeing there that a CRL issuer can issue certs.
>
>Alice is a CA.
>Alice is a CRL issuer.
>Alice is a CA => Alice issues certs

Alice, as a CA, issues certs.

>...drum roll...therefore..
>
>Alice is a CRL issuer && Alice issues certs

Alice, as a CRL issuer, issues CRLs. Full stop.

>[...]

>Huh? What about Alice?

  ... and what about Bob and Carol ?

Denis

>Stephen.