Subject: RE: 3280bis: Indirect CRL issue

From: "Santosh Chokhani" <[email-masked]>
Date: Tue, 14 Feb 2006 09:45:41 -0800

3280 bis is the most clear and accurate.

I do not see any problem or contradiction with 3280 bis in this area.

Denis's definition is inaccurate since an indirect CRL issuer can be CA,
but need not be a CA.  An indirect CRL can cover only one CA or more
than one.

I recommend that 3280 bis be not changed.

"The scope of an indirect CRL may be limited to certificates issued by a
*single* CA" is NOT in contradiction with the previous sentence
extracted from 3280bis: "the scope of the CRL includes *one or more*
certificates issued by an entity other than the CRL issuer".  A CA or
non-CA authority can issuer an indirect CRL on behalf of a single CA.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Denis Pinkas
Sent: Tuesday, February 14, 2006 11:20 AM
To: pkix
Subject: 3280bis: Indirect CRL issue

Before coming to the topic of indirect CRLs, it is important to note
that the definition 
of CRL issuer has been changed from:

3280   : CRL issuer: an optional system to which a CA delegates the
         publication of certificate revocation lists;

into :

3280bis: CRL issuer: a system that generates and signs CRLs;

Then note that we have now four different "definitions" of indirect CRL
:

3280 :    Whenever the CRL issuer is not the CA that issued the 
          certificates, the CRL is referred to as an indirect CRL.

3280bis : If the scope of the CRL includes one or more certificates 
          issued by an entity other than the CRL issuer, then it is 
          an indirect CRL. The scope of an indirect CRL may be limited 
          to certificates issued by a single CA or may include 
          certificates issued by multiple CAs.  If the issuer of the 
          indirect CRL is a CA, then the scope of the indirect CRL MAY 
          also include certificates issued by the issuer of the CRL.

X.509   : indirect CRL (iCRL): A revocation list that at least contains 
          revocation information about certificates issued by 
          authorities other than that which issued this CRL.

6 N 12793 CertificateEnhancementFPDAM : An indirect CRL [...] is a CRL 
          that contains a list of revoked certificates, in which some or
          all of those certificates were not issued by the authority 
          signing and issuing the CRL.

The following sentence extracted from 3280bis :"The scope of an indirect
CRL 
may be limited to certificates issued by a *single* CA" is in
contradiction with 
the previous sentence extracted from 3280bis: "the scope of the CRL
includes 
*one or more* certificates issued by an entity other than the CRL
issuer". 
The next sentence from 3280bis about the scope does not help either. 
X.509 or 6 N 12793 do not have these two additional sentences which
currently add confusion. 

Note the definition of the scope of the CRL extracted from 3280bis: 
"The CRL scope is the set of certificates that *could* appear on a given
CRL".

Since, by definition, a CRL issuer is a system that generates and signs
CRLs, 
it is NOT a system that generates and signs certificates. However the
same entity 
may be at the same time a certificate issuer and a CRL issuer.
Note that the strawman proposal below avoids to say "certificates issued
by a CRL Issuer".

Proposal:

          If the scope of the CRL includes one or more certificates 
          that could not be issued by the CA signing the CRL, or 
          includes one or more certificates that could be issued by 
          more than one CA for which the CRL Issuer received 
          delegation to issue revocation information, then it is an 
          indirect CRL.
  
Denis

---

From: "Stefan Santesson" <[email-masked]>
Date: Tue, 14 Feb 2006 18:13:28 -0000

I believe all referenced definitions are compatible.

Your text proposal is confusing, especially the use of "could not be
issued by" and "could be issued by".

I think we have concluded on this before.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Denis Pinkas
Sent: den 14 februari 2006 08:20
To: pkix
Subject: 3280bis: Indirect CRL issue

into :

Proposal:

Denis

---

From: "Denis Pinkas" <[email-masked]>
Date: Wed, 15 Feb 2006 15:02:05 +0100

Tom, 

Thank you for your input. I spent several hours to prepare a response. 
While I do not take your suggestions, I believe that the new proposal below 
is more likely to solve the issue. However, it raises a question at the very end.

The definition of CRL scope extracted from 3280bis is: 
“The CRL scope is the set of certificates that *could* appear on a given CRL”. 
Since “could appear” is used in that definition, sentences like 
the “scope MAY include” are inappropriate: see below. 

Introducing the “name of ” is more likely to solve the issue.

3280bis : If the scope of the CRL includes certificates issued by a CA
revised    that bears a name different from the name of the CRL issuer, 
              then it is an indirect CRL.  The scope of an indirect CRL 
              may be limited to certificates issued by a single CA or 
              may include certificates issued by multiple CAs.  
              If the issuer of the indirect CRL is a CA, then the scope of 
              the indirect includes certificates issued by more than one CA.
              If the issuer of the indirect CRL is a not a CA, then the 
              scope of the indirect includes certificates issued by one or 
              more CAs.

The problem of indirect CRLs is related to the indirectCRL boolean.
We have the same problem with “certificates issued by the CRL issuer”.

indirectCRL boolean in 3280bis: 

   If the scope of the CRL only includes certificates issued by the CRL
   issuer then the indirectCRL boolean MUST be set to FALSE.  Otherwise,
   if the scope of the CRL includes certificates issued by one or more
   authorities other than the CRL issuer, the indirectCRL boolean MUST
   be set to TRUE.

Correction proposal for the indirectCRL boolean: 

   If the scope of the CRL only includes certificates issued by a CA
   that bears a name identical to the name of the CRL issuer, then 
   the indirectCRL boolean MUST be set to FALSE.  Otherwise, if the 
   scope of the CRL includes certificates issued by a CA that bears 
   a name different from the name of the CRL issuer, then the 
   indirectCRL boolean MUST be set to TRUE.

The problem of indirect CRLs is related to the Certificate Issuer CRL entry extension.

Certificate Issuer (section 5.3.4) in 3280bis:

   If this extension is not present on the first entry in an
   indirect CRL, the certificate issuer defaults to the CRL issuer.

Correction proposal for the Certificate Issuer CRL entry extension:

   If this extension is not present on the first entry in an indirect 
   CRL, the name of the certificate issuer defaults to the name of 
   the CRL issuer.

Before closing(?) this debate, let us look at the three cases and then implications for implementers :

a) The CRL is signed by a CA. In that case the scope covers certificates issued by that CA and 
certificates issued by other CAs. The name of the CA is identical to the name of the CRL Issuer. 
The certification path to verify the signature of the CRL is identical to the certification path 
to verify the certificates issued by that CA.

b) The CRL is not signed by a CA. The CRL Issuer has been designated by more than one CA 
and has its own name. The certification path to verify the signature of the CRL is NOT identical 
to the certification path to verify the certificates issued by that CA. It includes one more certificate, 
where the CA designates the CRL Issuer.

c) The CRL is not signed by a CA. The CRL Issuer has been designated by only one CAs and 
has its own name. All the CRL entries relate to the same CA. The certification path to verify 
the signature of the CRL is NOT identical to the certification path to verify the certificates 
issued by that CA. It includes one more certificate, where the CA designates the CRL Issuer.

In case c), all revocation status information is for certificates issued by only one CA. 
It will mean that the Certificate Issuer CRL entry extension MUST appear on the first entry. 
However the relying party MUST still make sure that each subsequent entry does not contain 
another Certificate Issuer CRL entry extension. From a relying party point of view, 
would there be a way to distinguish between cases b) and c), and thus to avoid the test 
of the presence of a possible Certificate Issuer CRL entry extension in every CRL entry?

Denis

>        Denis:
>
>        First, it is worth noting that the usage of "CRL issuer" in the 
>clause you cited from 3280 is consistent with 3280-bis' definition and not 
>with 3280's.  The other two citations don't use the term "CRL issuer". 
>Second, the FPDAM's definition of indirect CRL is much more nearly 
>consistent with 3280-bis' than with 3280's, and I would argue that where 
>they differ the FPDAM is less accurate than 3280-bis - i.e., the scope of 
>the CRL determines whether it is indirect or not rather than the list of 
>revoked certificates doing so.  Thus, I see little wrong with the existing 
>wording.  To meet your semantic objection, we could simply change "by the 
>issuer of the CRL" to "by that CA" or "by the CA which signed and issued 
>the CRL".  Either of those wordings is indeed more precise than the 
>existing wording.  The phrase "an entity other than the CRL issuer" is 
>actually correct, although it could easily be changed to "an entity 
>distinct from the CRL issuer" or "an entity operated separately from the 
>CRL issuer".
>        I think 3280-bis' wording doesn't need that much work.
>
>                Tom Gindin
>
>
>
>
>
>"Denis Pinkas" <[email-masked]>
>Sent by: [email-masked]
>02/14/2006 11:20 AM
> 
>        To:     "pkix" <[email-masked]>
>        cc: 
>Before coming to the topic of indirect CRLs, it is important to note that 
>the definition 
>Then note that we have now four different ?definitions? of indirect CRL :
>
>The following sentence extracted from 3280bis :?The scope of an indirect 
>CRL 
>may be limited to certificates issued by a *single* CA? is in 
>contradiction with 
>the previous sentence extracted from 3280bis: ?the scope of the CRL 
>includes 
>*one or more* certificates issued by an entity other than the CRL issuer?. 
>
>?The CRL scope is the set of certificates that *could* appear on a given 
>CRL?.
>
>it is NOT a system that generates and signs certificates. However the same 
>entity 
>Note that the strawman proposal below avoids to say ?certificates issued 
>by a CRL Issuer?.
>
>Proposal:
>

Regards,

Denis Pinkas

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 16 Feb 2006 06:05:45 -0800

While Denis waits for Tom's response, I thought I share my analysis with
the rest of the community.

I have problems with Denis's proposal for the following reasons.

1.  The advocating of the use of "same name" is problematic since we
know that a CA and CRL issuer are identified and referred to by the
name.

2.  The use of the term "entity with same name" is problematic since
name uniqueness is not guaranteed.

3.  On the matter of distinguishing the case b and c for CRL entry
extension, there is no need for the relying party to know of case c.
The relying party will not encounter any more certificate issuer "CRL
Entry extension".  There is no disadvantage I see in the relying party
having to check the serial numbers in sequence from first to last as
opposed to other search methods (e.g., last to first).  In other words,
what Denis is asking for will necessitate a change to the standard that
impacts both the CAs and the clients and has no benefit that I can
discern.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Denis Pinkas
Sent: Wednesday, February 15, 2006 9:02 AM
To: Tom Gindin
Cc: pkix
Subject: Re: 3280bis: Indirect CRL issue

Tom, 

Thank you for your input. I spent several hours to prepare a response. 
While I do not take your suggestions, I believe that the new proposal
below 
is more likely to solve the issue. However, it raises a question at the
very end.

The definition of CRL scope extracted from 3280bis is: 
"The CRL scope is the set of certificates that *could* appear on a given
CRL". 
Since "could appear" is used in that definition, sentences like 
the "scope MAY include" are inappropriate: see below. 

Introducing the "name of " is more likely to solve the issue.

3280bis : If the scope of the CRL includes certificates issued by a CA
revised    that bears a name different from the name of the CRL issuer, 
              then it is an indirect CRL.  The scope of an indirect CRL 
              may be limited to certificates issued by a single CA or 
              may include certificates issued by multiple CAs.  
              If the issuer of the indirect CRL is a CA, then the scope
of 
              the indirect includes certificates issued by more than one
CA.
              If the issuer of the indirect CRL is a not a CA, then the 
              scope of the indirect includes certificates issued by one
or 
              more CAs.

The problem of indirect CRLs is related to the indirectCRL boolean.
We have the same problem with "certificates issued by the CRL issuer".

The problem of indirect CRLs is related to the Certificate Issuer CRL
entry extension.

Before closing(?) this debate, let us look at the three cases and then
implications for implementers :

a) The CRL is signed by a CA. In that case the scope covers certificates
issued by that CA and 
certificates issued by other CAs. The name of the CA is identical to the
name of the CRL Issuer. 
The certification path to verify the signature of the CRL is identical
to the certification path 
to verify the certificates issued by that CA.

b) The CRL is not signed by a CA. The CRL Issuer has been designated by
more than one CA 
and has its own name. The certification path to verify the signature of
the CRL is NOT identical 
to the certification path to verify the certificates issued by that CA.
It includes one more certificate, 
where the CA designates the CRL Issuer.

c) The CRL is not signed by a CA. The CRL Issuer has been designated by
only one CAs and 
has its own name. All the CRL entries relate to the same CA. The
certification path to verify 
the signature of the CRL is NOT identical to the certification path to
verify the certificates 
issued by that CA. It includes one more certificate, where the CA
designates the CRL Issuer.

In case c), all revocation status information is for certificates issued
by only one CA. 
It will mean that the Certificate Issuer CRL entry extension MUST appear
on the first entry. 
However the relying party MUST still make sure that each subsequent
entry does not contain 
another Certificate Issuer CRL entry extension. From a relying party
point of view, 
would there be a way to distinguish between cases b) and c), and thus to
avoid the test 
of the presence of a possible Certificate Issuer CRL entry extension in
every CRL entry?

Denis

>Before coming to the topic of indirect CRLs, it is important to note
that 

>*one or more* certificates issued by an entity other than the CRL
issuer?. 

>it is NOT a system that generates and signs certificates. However the
same 

Regards,

Denis Pinkas