IETF Logo Mail Archive

Re: Current status of CRL validation ?

Stephen Kent <kent@bbn.com> Wed, 07 April 2004 18:09 UTC

Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA22284 for <pkix-archive@lists.ietf.org>; Wed, 7 Apr 2004 14:09:02 -0400 (EDT)
Received: from above.proper.com (localhost.vpnc.org [127.0.0.1]) by above.proper.com (8.12.11/8.12.8) with ESMTP id i37H5kYI012380; Wed, 7 Apr 2004 10:05:46 -0700 (PDT) (envelope-from owner-ietf-pkix@mail.imc.org)
Received: (from majordom@localhost) by above.proper.com (8.12.11/8.12.9/Submit) id i37H5kp4012379; Wed, 7 Apr 2004 10:05:46 -0700 (PDT)
X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-pkix@mail.imc.org using -f
Received: from aragorn.bbn.com (aragorn.bbn.com [128.33.0.62]) by above.proper.com (8.12.11/8.12.8) with ESMTP id i37H5jEl012370 for <ietf-pkix@imc.org>; Wed, 7 Apr 2004 10:05:46 -0700 (PDT) (envelope-from kent@bbn.com)
Received: from [128.89.89.75] (dhcp89-089-075.bbn.com [128.89.89.75]) by aragorn.bbn.com (8.12.7/8.12.7) with ESMTP id i37H5d7Z013901; Wed, 7 Apr 2004 13:05:40 -0400 (EDT)
Mime-Version: 1.0
X-Sender: kent@po2.bbn.com
Message-Id: <p06020411bc99d1fab8e9@[128.89.89.75]>
In-Reply-To: <20040407144450.GA742@cryptolog.com>
References: <20040323103412.GA23286@cryptolog.com> <004f01c410dc$2c0681d0$df294d0c@hq.orionsec.com> <20040323142525.GA27672@cryptolog.com> <p06020406bc861b0a4627@[128.33.244.157]> <20040407144450.GA742@cryptolog.com>
Date: Wed, 07 Apr 2004 11:47:28 -0400
To: Julien Stern <julien.stern@cryptolog.com>
From: Stephen Kent <kent@bbn.com>
Subject: Re: Current status of CRL validation ?
Cc: ietf-pkix@imc.org
Content-Type: text/plain; charset="us-ascii"; format="flowed"
X-Scanned-By: MIMEDefang 2.28 (www . roaringpenguin . com / mimedefang)
Sender: owner-ietf-pkix@mail.imc.org
Precedence: bulk
List-Archive: <http://www.imc.org/ietf-pkix/mail-archive/>
List-ID: <ietf-pkix.imc.org>
List-Unsubscribe: <mailto:ietf-pkix-request@imc.org?body=unsubscribe>

Julien,

I think you must be a bit behind on reading PKIX mail, since Santosh 
and I have been discussing the indirect CRL issue for two days now.

In your example, the first flaw I see is that the cert in question is 
supposedly signed by two CAs (CA4 and CA5), which have the same DN 
and public keys. if they have the same DN and the same public key, 
then they are the same CA, so the example is broken at that point, 
period.

Steve

v2.46.0 | Report a Bug | By Email | System Status