Subject: 3280bis: CRL Entry Extensions

From: "Denis Pinkas" <[email-masked]>
Date: Wed, 15 Feb 2006 16:44:04 +0100

The text from 3280 was:

5.3  CRL Entry Extensions

   All CRL entry extensions used in this specification are non-critical.
   Support for these extensions is optional for conforming CRL issuers
   and applications.

The text in 3280bis is:

   Support for the CRL entry extensions defined in this specification is
   optional for conforming CRL issuers and applications.

You will note that the first sentence disappeared. In fact that statement 
was untrue since 3280 contained the description of a single critical 
crlEntryExtension: the Certificate Issuer CRL entry extension.

3280 contains the following sentence:

   A CRL validation MUST fail if it encounters a critical CRL entry extension
   which it does not know how to process.

3280bis contains a similar sentence:

   If a CRL contains a critical CRL entry extension that the 
   application cannot process then the application MUST NOT use 
   that CRL to determine the status of certificates.

The main difference between 3280 and 3280bis is that, based on the statement 
“all CRL entry extensions used in this specification are non-critical “, 
implementations conformant to 3280 could ignore CRL entry extensions, 
unless the CRL had a critical CRL extension which “advertised” the presence 
of critical CRL entry extensions.

Since CRL extensions are tested before CRL entry extensions, this was not a problem.

A CRL extension that is critical and not recognized invalidates the whole CRL.

A critical CRL entry extension that is critical and not recognized should normally 
invalidate the entry, not the whole CRL.

The Certificate Issuer CRL entry extension is the single CRL entry extension 
that affects subsequent CRL entries. All other CRL entry extensions defined 
at this time only affect the entry where they appear.

With the current text from 3280bis, implementers would have to test all remaining 
CRL entries from a CRL, even if a match on one CRL entry is found !

Unless clearly advertised otherwise using a critical crlExtensions field , 
the idea is to avoid to check the presence of crlEntryExtensions field in entries 
where the serial number of interest does not match. 

This can be achieved since the presence of the Certificate Issuer CRL entry extension 
is always announced using a critical CRL extension, i.e. the issuing distribution point 
CRL extension with the indirectCRL indicator set.

The general rule shall then be: 

“Unless indicated otherwise using a critical CRL extension in the crlExtensions field, 
a CRL entry extension only affects the certificate(s) specified in that entry”.

This sentence should replace the current sentence which is:

   If a CRL contains a critical CRL entry extension that the 
   application cannot process then the application MUST NOT use 
   that CRL to determine the status of certificates.

Other changes that are the consequence of this are staightforward.

Denis

---

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 15 Feb 2006 16:48:06 -0000

Denis,

I think you hit a valid point.
One should not have to further process the CRL once an entry matching
the target certificate has been found. This may have to be clarified.

However, we don't know if new or privately defined CRL entry extensions
may affect other entries.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Denis Pinkas
Sent: den 15 februari 2006 07:44
To: pkix
Subject: 3280bis: CRL Entry Extensions

The text from 3280 was:

5.3  CRL Entry Extensions

The text in 3280bis is:

You will note that the first sentence disappeared. In fact that
statement 
was untrue since 3280 contained the description of a single critical 
crlEntryExtension: the Certificate Issuer CRL entry extension.

   A CRL validation MUST fail if it encounters a critical CRL entry
extension
   which it does not know how to process.

The main difference between 3280 and 3280bis is that, based on the
statement 
"all CRL entry extensions used in this specification are non-critical ",

implementations conformant to 3280 could ignore CRL entry extensions, 
unless the CRL had a critical CRL extension which "advertised" the
presence 
of critical CRL entry extensions.

Since CRL extensions are tested before CRL entry extensions, this was
not a problem.

A CRL extension that is critical and not recognized invalidates the
whole CRL.

A critical CRL entry extension that is critical and not recognized
should normally 
invalidate the entry, not the whole CRL.

The Certificate Issuer CRL entry extension is the single CRL entry
extension 
that affects subsequent CRL entries. All other CRL entry extensions
defined 
at this time only affect the entry where they appear.

With the current text from 3280bis, implementers would have to test all
remaining 
CRL entries from a CRL, even if a match on one CRL entry is found !

Unless clearly advertised otherwise using a critical crlExtensions field
, 
the idea is to avoid to check the presence of crlEntryExtensions field
in entries 
where the serial number of interest does not match. 

This can be achieved since the presence of the Certificate Issuer CRL
entry extension 
is always announced using a critical CRL extension, i.e. the issuing
distribution point 
CRL extension with the indirectCRL indicator set.

"Unless indicated otherwise using a critical CRL extension in the
crlExtensions field, 
a CRL entry extension only affects the certificate(s) specified in that
entry".

Denis