Subject: 3280bis: Indirect CRL issue

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 14 Feb 2006 17:20:11 +0100

Before coming to the topic of indirect CRLs, it is important to note that the definition 
of CRL issuer has been changed from:

3280   : CRL issuer: an optional system to which a CA delegates the
         publication of certificate revocation lists;

into :

3280bis: CRL issuer: a system that generates and signs CRLs;

Then note that we have now four different “definitions” of indirect CRL :

3280 :    Whenever the CRL issuer is not the CA that issued the 
          certificates, the CRL is referred to as an indirect CRL.

3280bis : If the scope of the CRL includes one or more certificates 
          issued by an entity other than the CRL issuer, then it is 
          an indirect CRL. The scope of an indirect CRL may be limited 
          to certificates issued by a single CA or may include 
          certificates issued by multiple CAs.  If the issuer of the 
          indirect CRL is a CA, then the scope of the indirect CRL MAY 
          also include certificates issued by the issuer of the CRL.

X.509   : indirect CRL (iCRL): A revocation list that at least contains 
          revocation information about certificates issued by 
          authorities other than that which issued this CRL.

6 N 12793 CertificateEnhancementFPDAM : An indirect CRL [...] is a CRL 
          that contains a list of revoked certificates, in which some or
          all of those certificates were not issued by the authority 
          signing and issuing the CRL.

The following sentence extracted from 3280bis :“The scope of an indirect CRL 
may be limited to certificates issued by a *single* CA” is in contradiction with 
the previous sentence extracted from 3280bis: “the scope of the CRL includes 
*one or more* certificates issued by an entity other than the CRL issuer”. 
The next sentence from 3280bis about the scope does not help either. 
X.509 or 6 N 12793 do not have these two additional sentences which currently add confusion. 

Note the definition of the scope of the CRL extracted from 3280bis: 
“The CRL scope is the set of certificates that *could* appear on a given CRL”.

Since, by definition, a CRL issuer is a system that generates and signs CRLs, 
it is NOT a system that generates and signs certificates. However the same entity 
may be at the same time a certificate issuer and a CRL issuer.
Note that the strawman proposal below avoids to say “certificates issued by a CRL Issuer”.

Proposal:

          If the scope of the CRL includes one or more certificates 
          that could not be issued by the CA signing the CRL, or 
          includes one or more certificates that could be issued by 
          more than one CA for which the CRL Issuer received 
          delegation to issue revocation information, then it is an 
          indirect CRL.
  
Denis

---

From: Tom Gindin <[email-masked]>
Date: Tue, 14 Feb 2006 23:31:37 -0500

Denis:

        First, it is worth noting that the usage of "CRL issuer" in the 
clause you cited from 3280 is consistent with 3280-bis' definition and not 
with 3280's.  The other two citations don't use the term "CRL issuer". 
Second, the FPDAM's definition of indirect CRL is much more nearly 
consistent with 3280-bis' than with 3280's, and I would argue that where 
they differ the FPDAM is less accurate than 3280-bis - i.e., the scope of 
the CRL determines whether it is indirect or not rather than the list of 
revoked certificates doing so.  Thus, I see little wrong with the existing 
wording.  To meet your semantic objection, we could simply change "by the 
issuer of the CRL" to "by that CA" or "by the CA which signed and issued 
the CRL".  Either of those wordings is indeed more precise than the 
existing wording.  The phrase "an entity other than the CRL issuer" is 
actually correct, although it could easily be changed to "an entity 
distinct from the CRL issuer" or "an entity operated separately from the 
CRL issuer".
        I think 3280-bis' wording doesn't need that much work.

                Tom Gindin

"Denis Pinkas" <[email-masked]>
Sent by: [email-masked]
02/14/2006 11:20 AM
 
        To:     "pkix" <[email-masked]>
        cc: 
        Subject:        3280bis: Indirect CRL issue

Before coming to the topic of indirect CRLs, it is important to note that 
the definition 
of CRL issuer has been changed from:

into :

Then note that we have now four different ?definitions? of indirect CRL :

The following sentence extracted from 3280bis :?The scope of an indirect 
CRL 
may be limited to certificates issued by a *single* CA? is in 
contradiction with 
the previous sentence extracted from 3280bis: ?the scope of the CRL 
includes 
*one or more* certificates issued by an entity other than the CRL issuer?. 

The next sentence from 3280bis about the scope does not help either. 
X.509 or 6 N 12793 do not have these two additional sentences which 
currently add confusion. 

Note the definition of the scope of the CRL extracted from 3280bis: 
?The CRL scope is the set of certificates that *could* appear on a given 
CRL?.

Since, by definition, a CRL issuer is a system that generates and signs 
CRLs, 
it is NOT a system that generates and signs certificates. However the same 
entity 
may be at the same time a certificate issuer and a CRL issuer.
Note that the strawman proposal below avoids to say ?certificates issued 
by a CRL Issuer?.

Proposal:

Denis