RE: not required to support IDP?

["Simon Tardell" <[e-mail]>]

Hi Hiro,

Of course, whatever extension is critical that you don't understand,
must cause you to reject the CRL. However, according to X.509(97) 12.6.1
f) a complete CRL shall always be issued, even if partitioned CRLs are
also issued. That means that you don't have to support partitioned CRLs,
since there is always (if the CA is X.509 compliant) a complete CRL to
get. For many applications, partitioning CRLs may not even be the best
answer to the problem you try to solve (depending on the problem of
course).

Simon

Simon Tardell, Software Architect, SmartTrust
voice [phone], fax [phone]
cell [phone], [e-mail]


> -----Original Message-----
> From: Hiro [mailto:[e-mail]] 
> Sent: den 20 februari 2002 14:57
> To: [e-mail]
> Subject: not required to support IDP?
> 
> 
> 
> 
> Hi,
> I have one question about Issuing Distribution Point 
> Extension. In RFC2459 and draft-ietf-pkix-new-part1-12.txt, 
> about this extension
> 
>     "Although the extension is critical, conforming implementations
>      are not required to support this extension."
> 
> I cannot understand.
> I think it is not only conflicting with critical flag 
> concept, but also, if a CA is issuing CRL/ARL(not complete 
> CRL) and it happen the CRL 
> substitution attack
> on the directory, EE should be find this attack.
> So I think this extension must be supported.
> 
> Does anyone answer for this question?
> 
> Regard,
> 
> 
> 
> --
> Hiro
> [e-mail]
> 
> 
>