Subject: 3280Bis: CRL Validation

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 14 Feb 2006 17:20:10 +0100

3280bis states in section 6.3  CRL Validation

   This algorithm assumes that all of the needed CRLs are available 
   in a local cache.

However, it does not say a single word on how to select the appropriate CRL 
among all theses CRLs, and in particular how to verify that the selected CRL 
is correctly signed.

I have proposed a detailed text that covers this aspect, but this text has not been 
incorporated by the editor(s).

Either explanations should be added (much better to allow interoperability of implementations) 
or the 3280bis should say that it is silent about this issue.

Denis

---

From: "Stefan Santesson" <[email-masked]>
Date: Tue, 14 Feb 2006 17:32:28 -0000

Denis,

Rfc3280bis is not silent.

It states
      (f)  Obtain and validate the certification path for the issuer of
      the complete CRL.  If a key usage extension is present in the CRL
      issuer's certificate, verify that the cRLSign bit is set.

      (g)  Validate the signature on the complete CRL using the public
      key validated in step (f).

How to validate the path is described in section 6.

You know that you have a valid CRL through following the steps of 6.3.
You don't need to know that before you start the processing.

This is all I need as implementer.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Denis Pinkas
Sent: den 14 februari 2006 08:20
To: pkix
Subject: 3280Bis: CRL Validation

However, it does not say a single word on how to select the appropriate
CRL 
among all theses CRLs, and in particular how to verify that the selected
CRL 
is correctly signed.

I have proposed a detailed text that covers this aspect, but this text
has not been 
incorporated by the editor(s).

Either explanations should be added (much better to allow
interoperability of implementations) 
or the 3280bis should say that it is silent about this issue.

Denis

---

From: "Santosh Chokhani" <[email-masked]>
Date: Tue, 14 Feb 2006 09:51:42 -0800

In terms of correctly signed part, see section 6.3.3 items f and g.
Also, see the requirement for certification path emanation from the same
root in Security consideration section.  I think that the security
consideration section statement should be added to 6.3.3 item f.  Aside
from that, unless the certification path proposal I made is adopted,
3280 bis is fine.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Denis Pinkas
Sent: Tuesday, February 14, 2006 11:20 AM
To: pkix
Subject: 3280Bis: CRL Validation

Denis