RE: not required to support IDP?

["David A. Cooper" <[e-mail]>]

Simon,

I agree that PKIX did not mean to suggest that one could CRL containing a critical IDP extension even if you can not process the extension. PKIX is simply saying that you are not required to have the ability to process the extension, even though this will mean that you may have to reject some CRLs.

However, X.509 does not require that a CA issue full CRLs. If this requirement did appear in X.509 (1997), it has been removed in X.509 (2000). In fact, X.509 makes clear that CAs may choose not to issue CRLs at all. Either because they to not revoke certificates or because they only publish revocation information using some other mechanism (e.g., OCSP).

So, an X.509 compliant CA could issue only partitioned CRLs, in which case a relying party that could not process the IDP extension would be unable to obtain revocation information.

Dave

At 04:53 PM 2/20/02 +0100, Simon Tardell wrote:

>Hi Hiro,
>
>Of course, whatever extension is critical that you don't understand,
>must cause you to reject the CRL. However, according to X.509(97) 12.6.1
>f) a complete CRL shall always be issued, even if partitioned CRLs are
>also issued. That means that you don't have to support partitioned CRLs,
>since there is always (if the CA is X.509 compliant) a complete CRL to
>get. For many applications, partitioning CRLs may not even be the best
>answer to the problem you try to solve (depending on the problem of
>course).
>
>Simon
>
>Simon Tardell, Software Architect, SmartTrust
>voice [phone], fax [phone]
>cell [phone], [e-mail]
>
>
> > -----Original Message-----
> > From: Hiro [mailto:[e-mail]] 
> > Sent: den 20 februari 2002 14:57
> > To: [e-mail]
> > Subject: not required to support IDP?
> > 
> > 
> > 
> > 
> > Hi,
> > I have one question about Issuing Distribution Point 
> > Extension. In RFC2459 and draft-ietf-pkix-new-part1-12.txt, 
> > about this extension
> > 
> >     "Although the extension is critical, conforming implementations
> >      are not required to support this extension."
> > 
> > I cannot understand.
> > I think it is not only conflicting with critical flag 
> > concept, but also, if a CA is issuing CRL/ARL(not complete 
> > CRL) and it happen the CRL 
> > substitution attack
> > on the directory, EE should be find this attack.
> > So I think this extension must be supported.
> > 
> > Does anyone answer for this question?
> > 
> > Regard,
> > 
> > 
> > 
> > --
> > Hiro
> > [e-mail]