Subject: RE: Certificate Validity Problem

From: "Ersin Gulacti" <[email-masked]>
Date: Sun, 18 Dec 2005 23:12:47 +0200 (EET)

In reply to my recent post Anders Rundgren proposed the following

> If you really want to create something new in this area, why
> not create this "Monitor This Certificate" protocol?  Such
> a protocol would send an alert to all "subscribers"
> the_moment_it_has_been_found_out  that a key was on the loose.
> This seems to be a more "proactive" approach than SCVP (which
> requires constant polling in order to achieve something similar).

I couldn't reply him in private so I am writing in public (email bounces
back). The proactive approach might help users who are aware of the
situation but users who are not aware of the revoked or suspended
(on-hold) certificate problems will not subscribe to such a service and
will not receive notifications. On the other hand think of a very large
PKI implementation with more than 100K users. In such a system you will be
distracted by the email notifications sent by the CA notification service.
After sometime you will start ignoring and deleting such notifications.

In my opinion "Certificate History Retrieval Protocol" could be very
useful in two areas. One area is to retrieve a certificate from the CA by
using the certificates' serial number. This is very helpful if you want to
track the list of users who are capable of deciphering an enciphered file.
You can't use a directory service because you can't use a certificate
serial number as a filter for an LDAP search. (Actually we have
implemented this functionality as a service in our CA software.)

The other area is to track the full history of the certificate. You can
query the "Certificate History Retrieval Service" with a specific
certificate serial number and the service will return you a full list of
history records for that certificate. The response from the service should
be signed by the CA. This trusted information can be used by many
participants of the PKI: end users who do the full certificate validation,
SCVP services etc.

I would like to learn the procedure of writing this as an RFC proposal.
Would it be enough to convince the members of this mail-list ? :)

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 19 Dec 2005 09:35:20 -0800

At 01:12 PM 12/18/2005, Ersin Gulacti wrote:
>serial number as a filter for an LDAP search.

Actually, one can do this using LDAP Component Matching (RFC 3687].
This standards-track LDAP extension is implemented in at least two
currently shipping LDAP server products.

And, if you also know the issuer, one can use the
certficateExactMatch matching rule [draft-zeilenga-ldap-x509].
This standards-track RFC-to-be is implemented in at least two
currently shipping LDAP server products.  It's to be published
with the revised LDAP TS produced by the LDAPBIS WG.  (Of course,
the X.500 directory service has supported this matching rule for
ages.)

Kurt