RE: CRLs

[[e-mail]]

Hi Dean,
	I was thinking about CRLDistributionPoint. But the question is how
to verify such CRL, and what about CRL extensions and entry extension. From
the begining.
1. What exactly should include field cRLIssuer in CRLDistributionPoint
extension?
2. I should received verification path for the cert, which signed CRL. And I
think that the root certificate should the one, which sign certificate.
Otherwise it's possible to create false CRL (maybe I'm wrong, I don't know
the answer to question #1).
3. What about CRL extension: Issuing Distribution Point - to indicate that
CRL is indirect, and CRL entry extension: Certificate Issuer - to identify
certificate issuer.

In general, how such CRL should be validated? I think that standard is not
consistent, and should be changed.


Regards,

Pawel Krupinski


-----Original Message-----
From: Dean Povey [mailto:[e-mail]]
Sent: Tuesday, March 27, 2001 1:25 AM
To: [e-mail]
Cc: [e-mail]
Subject: Re: CRLs 



>Hi,
>	I'm trying to split CA functionality. I want to have one private key
>to sign certificates (CA key), and the second one to sign CRLs.
>	First is it possible to do it? Because in the standard I've found:
>"The CRL is signed using the CA's private key." (is it the same CA, which
>sign this certificate? In other words, CA can only revoke certificates it
>signed, Am I right?)

Hi Pawel,

You can use the cRLDistributionPoint extension to indicate a CRL issuer 
other than the CA that issued the Certificate.  See section 4.2.1.14 of
RFC2459, or of the updated Cert and CRL profile at:

http://www.ietf.org/internet-drafts/draft-ietf-pkix-new-part1-05.txt

-- 
Dean Povey,         | e-m: [e-mail] | JCSI:  Java Crypto Toolkit 
Research Scientist  | ph:  [phone]   | uPKI:  C PKI toolkit for
embedded
Security Unit, DSTC | fax: [phone]   |        systems
Brisbane, Australia | www: security.dstc.com | Oscar: C++ PKI toolkit