RE: clarification proposal -- Re: Current status of CRL validation ?

["Santosh Chokhani" <[e-mail]>]

Steve:

I do not have objection to parts of the first paragraph.  But, the first two
sentences of the paragraph are not accurate by most interpretations.  I
quote:

"In X.509/PKIX only the issuer of a certificate can revoke it and there is
only one issuer for a given certificate. Therefore, a certificate is either
revoked or not."

Through indirect CRL issuer mechanism (as defined in X.509 and in 3280), an
indirect CRL issuer can revoke a certificate with or without the knowledge
of the certificate issuing CA.  Since neither standard provide operations
related guidance (lack of this guidance is appropriate in the case of both
the standards), a subscriber can directly contact indirect CRL issuer and
have their certificate placed on the CRL.

-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On
Behalf Of Stephen Kent
Sent: Tuesday, April 06, 2004 9:31 AM
To: Ed Gerck
Cc: [e-mail]
Subject: Re: clarification proposal -- Re: Current status of CRL validation
?



At 3:31 PM -0700 4/5/04, Ed Gerck wrote:
>Stephen Kent wrote:
>>  Ed,
>>
>>  PKIX is winding down now; we are not taking on any new work items. I  
>> suspect that anything as basic as what you allude to would be a  
>> significant departure from what we have done, and thus is not  
>> appropriate for PKIX to pursue.
>
>Steve,
>
>How about a clarification to be added to the current PKIX documents 
>that deal with revocation and validation of certs? This would help the 
>weary reader, who must otherwise wade through this list's archives in 
>order to find the limitations we have been discussing. For example 
>(using some of your previous text):
>
>NOTE:
>  In X.509/PKIX only the issuer of a certificate can revoke it and 
>there
>  is only one issuer for a given certificate. Therefore, a certificate
>  is either revoked or not. However, the ability of a RP to establish
>  the validity of a certificate is a function of the certificate path
>  that the RP uses to validate the certificate, and of the access to
>  revocation status information available to the RP. Since there may be
>  more than one path used to validate the same certificate, it is possible
>  to obtain different answers to the question whether a certificate is
>  valid, depending on which path the RP uses. Also, two RPs may have
>  access to different revocation status data for the EE certificate or for
>  a CA certificate along a path, so that each RP may arrive at a different
>  view of the validity of the EE certificate at any given time.
>
>  Moreover, in X.509/PKIX reliance terms, one may trust the 
> confirmation  procedures of the issuer CA, the issuer CA Designated 
> Responder or any  Trusted Responder during certificate reliance (i.e., 
> whether the  certificate has been revoked or not) under CRLs or OCSPs, 
> but one cannot  rely upon them for other than their value as a 
> representation of the  issuer CA revocation management as expressed in 
> the issuer CA own terms  and rules, usually contained in the CA CPS.
>
>Comments?
>
>Cheers,
>Ed Gerck

We have a suggestion before the WG to issue an update to 3280, so the 
WG can decide if text of the sort noted above should be part of the 
update, if we proceed on that work item.

With regard to the text above, I like the first paragraph :-), but 
the second one becomes murky very quickly. The paragraph doesn't 
convey any meaning to me.
It probably doesn't help that the paragraph is one, 6 line sentence, 
or that it introduces terms such as "CA Designated Responder," 
"Trusted Responder," ...

Steve