Re: Current status of CRL validation ?

["Santosh Chokhani" <[e-mail]>]

Please see responses below.

On Tue, 30 Mar 2004 15:52:25 -0800, Ed Gerck wrote
> Julien,
> 
> Yes, a PKIX cert is either revoked or not. Yes, this is strictly enforceable
> in X.509 because: (a) a cert has only one issuer and, (b) only that 
> issuer of the cert can revoke the cert.

Not true. A certificate can be revoked by another authority as asserted in 
the CRL issuer field of the CDP of the certificate.

> However, X.509 is unable to 
> allow a RP to measure with any desired confidence (i.e., desired by 
> the RP) whether a cert is revoked or not.
> 
> This is due to several unsolvable problems in the X.509/PKIX 
> framework [1]. For example, there may be a considerable delay (no 
> warranties on the CAs CPSs can be found on upper limits for such 
> delays) between the actual need to revoke a certificate and the 
> reflection of this need in a certificate chain with different CAs. 
> Further, the major X.509 security application today, SSL, still does 
> not check revocation lists or any other revocation mechanisms -- so 
> they are near to useless. Also, the user is not able to check server 
> certificates (and certificates in the CA chains) against revocation 
> lists. 

This is not a standards, PKI, X.509 or PKIX problem.  It is an implementation 
problem.

> 
> Moreover, PKIX/X.509 revocation is a "will" to revoke but not an 
> actual revocation. Few recognize, as you have now hit, that cert revocation
> in PKIX/X.509 is a solution to a non-existent problem ... while the 
> real problem is left utterly unsolved. The non-existent problem 
> solved by PKIX/X.509 cert revocation is how to communicate that a 
> certificate is no longer valid ... because if a certificate were 
> really no longer valid 
> (as it should be) then no one would need to find the cert revocation 
> to know about it. 

Please clarify what you mean by "will to revoke" and "actual revocation"

> 
> Cheers,
> Ed Gerck
> 
> [1] http://nma.com/mcg-mirror/cert.htm