Re: PEM CRL registration for storage in X.500 databases

[Mike Roe <[e-mail]>]

> Below is a message from Peter Williams describing how UCL has registered
> PEM CRLs as an X.500 attribute syntax. I thought people on this list might
> want to know about it.

Yes, I was very interested to see it!

The original intention of the PASSWORD project was to register the
PEM CRL as an official COSINE/Internet schema attribute, by going through
the formal procedure for registering a new attribute laid down in RFC 1274.
UCL were supposed to be doing this....

Anyway, to make sure it gets done by some-one, I've just submitted a request
for the new attributes & object classes through the official channel. 

If it turns out that someone else has already done this, I'll just get told
I've submitted a duplicate request.

Mike

---- forwarded message
Delivery-Date: Tue, 1 Jun 1993 19:07:34 +0100
Received: from smew.cl.cam.ac.uk (user mrr (rfc931)) by swan.cl.cam.ac.uk 
          with SMTP (PP-6.5) to cl; Tue, 1 Jun 1993 19:07:05 +0100
To: [e-mail]
cc: [e-mail]
Subject: Attributes and object classes for Privacy Enhanced Mail
Date: Tue, 01 Jun 93 19:07:01 +0100
From: Mike Roe <[e-mail]>
Message-ID: <"swan.cl.cam.:063110:930601180732"@cl.cam.ac.uk>


Dear Sir,

I would like to propose the following attributes and object classes for
addition to the COSINE and Internet X.500 Schema described in RFC 1274.

These new attributes and object classes are needed to support the Privacy
Enhanced Mail protocol, which is defined in RFC 1422.

Yours sincerely,
Michael Roe
Cambridge University Computer Laboratory

*****************************************************************************
Object Class: Internet Certification Authority

Description: The Internet Certification Authority object class represents
a Certification Authority which supports the certificate-based key distribution
mechanism described in RFC 1422, ``Privacy Enhancement for Internet Electronic 
Mail: Part II: Certificate-Based Key Management''. 

ASN1OCMacro: internetCertficationAuthority OBJECT-CLASS
    SUBCLASS OF top 
    MUST CONTAIN {
       caCertificate,
       internetCertificateRevocationList,
       internetAuthorityRevocationList }
     MAY CONTAIN {
       crossCertificatePair}
*****************************************************************************
Attribute Type: Internet Certificate Revocation List

Description: The Internet Certificate Revocation List attribute identifies
user certificates which have been revoked and should be rejected as invalid.

OCMust: internetCertificationAuthority

OCMay:

ASN1ATMacro: internetCertificateRevocationList ATTRIBUTE
    WITH ATTRIBUTE-SYNTAX
        internetCertificateListSyntax
*****************************************************************************
Attribute Type: Internet Authority Revocation List

Description: The Internet Authority Revocation List attribute identifies
CA certificates which have been revoked and should be rejected as invalid.

OCMust: internetCertificationAuthority

OCMay:

ASN1ATMacro: internetCertificateRevocationList ATTRIBUTE
    WITH ATTRIBUTE-SYNTAX
        internetCertificateListSyntax
*****************************************************************************
Attribute Syntax: Internet Certificate List Syntax

Description: The Internet Certificate List syntax is used to represent a 
a signed and time-stamped list of certificate serial numbers. The 'issuer'
field names the authority responsible for maintaining the list. The 'lastUpdate'
field contains the time at which the list was issued. The 'nextUpdate' 
field contains the time at which the issuer expects to issue a revised list.

ASN1SyMacro: internetCertificateListSyntax ATTRIBUTE-SYNTAX
	CertificateRevocationList
	MATCHES FOR EQUALITY

CertificateRevocationList ::= SIGNED SEQUENCE{
        signature       AlgorithmIdentifier,
        issuer          Name,
        lastUpdate      UTCTime,
        nextUpdate      UTCTime,
        revokedCertificates
                        SEQUENCE OF CRLEntry OPTIONAL}

CRLEntry ::= SEQUENCE{
        userCertificate SerialNumber,
        revocationDate UTCTime}
*****************************************************************************

---- end forwarded message