Subject: Re: 3280bis: CRL validation

From: "Denis Pinkas" <[email-masked]>
Date: Mon, 13 Jun 2005 10:13:35 +0100

Santosh,

Since it took you less thah 15 minutes to reply, it means that you did not pay 
enough attention to the content of my short message.  :-)

>Denis,

>We may be solving different problems.  

Certainly. You try to solve a more complex problem that belongs to the case b) category.
Once case a) is solved, then we can talk of the "zillions" cases b).

> I am solving the problem of names not being unique.  

You would have to be more specific so that I can really make sure what you mean here.

> There is no need or benefit to adding a new extension.

As far as I am concerned, I am using currently defined extensions.

>May be you are proposing to list the names of the CA's in the path in this
>extension.  

This was my proposal to solve the "zillions cases", but not to solve case a).

> If so, the solution does not fit today's extensions and lacks
>agility of the algorithm I proposed and has the same or greater complexity.

For case a), one single name is necessary. That name cannot be ambiguous 
since it can only be given by the CA that has issued the target certificate.  

My point is the following:

"For case a), the name(s) contained in certificateIssuer MUST be certified 
by the CA that has issued the certificate where the extension appears".

Denis

>It will not reduce the complexity since the same matching will be requiring.
>
>You saying that you do not understand my posting is akin to turning a deaf
>ear to a discussion.
>
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On
>Behalf Of Denis Pinkas
>Sent: Friday, June 10, 2005 12:55 PM
>To: [email-masked]; Santosh Chokhani
>Subject: Re: RE: 3280bis: CRL validation
>
>
>
> >Denis,
>
>>What is your solution?
>
>There are two cases to consider for CRL issuers.
>
>  a) the CRL Issuer issues revocation information for a single CA;
>  b) the CRL Issuer issues revocation information for more than one CA.
>
>Case a) is simple, while case b) is more much complex (this is the "zillions
>of cases").
>
>We may have a simple and secure rule for case a). 
>The certificateIssuer extension from a certificate is defined as :
>
>     certificateIssuer ::= GeneralNames
>
>with 
>
>     certificateIssuer ::= GeneralNames
>
>with
>
>     GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
>
>In that case the name(s) contained in certificateIssuer MUST be certified by
>the CA that has issued the certificate where the extension appears.
>
>This means that the CRL Issuer can only be nominated by the CA that has
>issued the certificate.
>
>Denis

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 13 Jun 2005 09:46:21 -0400

Denis,

It is not clear from this e-mail thread what the solution is, what the
certificate issuer as the existing extension is (unless you mean the CRL
entry extension, which is not required or recommended and is useless in the
direct CRL).  It is also not clear what problem this solution is addressing.

The problem I am addressing is as follows.  Let us say that there are
following PKIs:

Root 1 --> CA A --> Orion
Root 2 --> CA B --> CA I --> Orion
Root 2 --> CA C --> CA J --> Orion

Assuming that the three Orions are distinct, I am addressing the problem
that the wrong CRL does not get fetched and used.

If you can describe how you solve this problem, what extensions certificates
and CRLs have in them and what the relying parties do with them, I will be
happy to determine if the solution deals with the problem and if it is less
complex than what I proposed.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Denis Pinkas
Sent: Monday, June 13, 2005 5:14 AM
To: [email-masked]; Santosh Chokhani
Subject: Re: 3280bis: CRL validation

Santosh,

Since it took you less thah 15 minutes to reply, it means that you did not
pay 
enough attention to the content of my short message.  :-)

>We may be solving different problems.

Certainly. You try to solve a more complex problem that belongs to the case
b) category. Once case a) is solved, then we can talk of the "zillions"
cases b).

> I am solving the problem of names not being unique.

You would have to be more specific so that I can really make sure what you
mean here.

>May be you are proposing to list the names of the CA's in the path in 
>this extension.

This was my proposal to solve the "zillions cases", but not to solve case
a).

> If so, the solution does not fit today's extensions and lacks agility 
>of the algorithm I proposed and has the same or greater complexity.

Denis

>You saying that you do not understand my posting is akin to turning a 
>deaf ear to a discussion.
>
>From: [email-masked] 
>[mailto:[email-masked]] On Behalf Of Denis Pinkas
>Case a) is simple, while case b) is more much complex (this is the 
>"zillions of cases").
>
>In that case the name(s) contained in certificateIssuer MUST be 
>certified by the CA that has issued the certificate where the extension 
>appears.
>