Subject: RE: draft-pinkas-pkix-conf-crl-validation-00.txt

From: "Stefan Santesson" <[email-masked]>
Date: Tue, 28 Jun 2005 22:28:49 +0100

Denis,

I recognize the extensive work that must have gone in to this draft, but
to be honest, I don't think it is very helpful.

What you have done is a complete re-write of the CRL validation section
where you have changed far more stuff than was part of this discussion.

And in the effort you have also introduced new errors and
vulnerabilities and cut support for many features. For example you
terminate processing to "UNREVOKED" when processing is not concluded and
likewise your algorithm would totally miss a partitioned CRL and would
conclude a potentially revoked certificate as unrevoked if CDP/IDP
doesn't match.

These are just a few examples of problems with your text.

As conclusion I think it is beyond the scope of the reasonable work of
3280bis to even consider a complete rewrite of section 6.3.

What I think this list needs instead is a write-up of your requirements
for a solution and your suggested principal changes to 3280.

My 2 cents

/Stefan

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Denis Pinkas
> Sent: den 28 juni 2005 18:14
> To: pkix
> Subject: draft-pinkas-pkix-conf-crl-validation-00.txt
> 
> 
> 
> This is to let you know that the following I-D has been published:
> "Conforming CRL Validation for relying parties".
> 
> It is available at:
>
http://www.ietf.org/internet-drafts/draft-pinkas-pkix-conf-crl-validatio
n-
> 00.txt
> 
> Abstract
> 
>    The text currently present in section 6.3 from RFC 3280 is
dedicated
>    to CRL validation. This text needs to be more detailed to explain
>    exactly how it can made be sure that a CRL is issued by the right
>    entity.  In addition, a text dedicated to the characteristics that
>    conforming applications MUST support needs to be provided: the
>    current text covers the most complex case and is too complicated to
>    be easily simplified.  Text is proposed to be included in 3280 bis
>    and to partially replace section 6.3 .
> 
> Denis