Re: [pkix] An alternative proposal Was: Fwd: New Version Notification for draft-hamilton-cmr-00.txt

["Miller, Timothy J." <[e-mail]>]

So let me summarize the problem(s) that I think you're trying to address:

1. A CA is defrauded and issues certificates (e.g. Verisign, 2001).

2. A CA is compromised and issues certificates (e.g. DigiNotar et.al.,
2011).

3. A Subscriber certificate fraudulently claims to be issued from a CA
where it was not, in fact, issued.

In (1), blacklisting the issued certificates works; whitelisting gains you
nothing.  When the fraud is detected, the certificates are revoked, the
CRL works its way through the infrastructure, and eventually no-one trusts
the fraudulent certificates.  Whitelisting is ineffective because the
fraudulent certificates *are on the whitelist* (at least until they are
discovered, at which point they move to the blacklist).

In (2), neither blacklisting nor whitelisting the issued certificates is
effective because the CA is authoritative for the both.  A malicious
trusted user of the CA can remove revoked certificates from the CRL, and
can insert certificate records into the database.  The only effective
response in this case is to blacklist the CA, which invalidates anything
that CA has issued.

In (3), the fraud should be detected by certificate path discovery.  The
claimed issuer won't be in the discovered path, and the whitelist is never
referenced.  What they relying party does with this information is their
own decision.

CRLs may be insufficient in some cases; e.g., the Verisign incident
involved code signing certificates which for good or ill have a special
validation logic, and a general lack of CRL checking meant that DigiNotar
CA revocation weren't being honored.  However, the 'fix' for both cases
was just another form of blacklisting (e.g., see "Untrusted Certificates"
in any Windows CAPI instance).

Finally, we know with CRLs that too many relying parties simply ignore
them.  Why would whitelists (CVLs?  NegaCRLs?) be any different?  What
compels a relying party to check a whitelist when it currently doesn't
check a blacklist?

And on a personal note, I'm not trying to 'veto' anything.  IETF doesn't
work that way.  I'm just trying to understand what the goal is and give my
opinion.

-- T