Re: [pkix] [x500standard] SV: Re: SV: Indirect CRLs

[Stephen Farrell <[e-mail]>]

On 20/11/15 16:33, Erik Andersen wrote:
> Hi Santosh,
> 
> Thanks a lot. That would be very helpful. I am quite pressed for time. It is
> the plan to have the next edition of X.509 ready at ITU-T  September next
> year. This is necessary, as the smart grid security people need to reference
> X.509 for their use of authorization and validation lists (whitelists). To
> meet the schedule, I need to have the next PDAM out for ballot at the end of
> this month. The same applies for a technical corrigendum covering all
> identified defects.

A suggestion: why not make that draft visible to folks here. I think
you'd get comments that would improve it.

S.

> 
> Regards,
> 
> Erik
> 
> -----Oprindelig meddelelse-----
> Fra: pkix [mailto:[e-mail]] På vegne af Santosh Chokhani
> Sendt: 20 November 2015 16:44
> Til: [e-mail]; 'PKIX' <[e-mail]>
> Emne: Re: [pkix] [x500standard] SV: Re: SV: Indirect CRLs
> 
> Erik,
> 
> I am happy to help craft or review additional exposition if that helps.
> 
> -----Original Message-----
> From: [e-mail]
> [mailto:[e-mail]] On Behalf Of Erik Andersen
> Sent: Friday, November 20, 2015 6:00 AM
> To: [e-mail]; 'PKIX' <[e-mail]>
> Subject: [x500standard] SV: Re: SV: [pkix] Indirect CRLs
> 
> Hi Santosh,
> 
> Try to imagine a guy that is completely new in PKI and pick-up X.509 or RFC
> 5280 to learn about it. Will he understand what an indirect CRL is by just
> looking at some brief statements on an iCRL is.
> 
> 8.5.2.2	CRL scope extension (deprecated) has the following statements:
> 
> –	simple CRLs that provide revocation information about certificates
> issued by a single authority; 
> –	indirect CRLs that provide revocation information about certificates
> issued by multiple authorities;
> 
> It was a statement like this that made me wrongly to believe that it is only
> an iCRL if there are certificate info from multiple authorities.
> 
> I also some comments on your other mail.
> 
> Regards,
> 
> Erik
>  
> 
> -----Oprindelig meddelelse-----
> Fra: [e-mail]
> [mailto:[e-mail]] På vegne af Santosh Chokhani
> Sendt: 19 November 2015 19:52
> Til: [e-mail]; 'PKIX' <[e-mail]>
> Emne: [x500standard] Re: SV: [pkix] Indirect CRLs
> 
> Erik,
> 
> Look at Section 8.6.2.1 of X.509 and I quote the following: "The cRLIssuer
> component identifies the authority that issues and signs the CRL. If this
> component is absent, the CRL issuer name defaults to the certificate issuer
> name."
> 
> Also see Section C.5.1.4 of X.509
> 
> -----Original Message-----
> From: [e-mail]
> [mailto:[e-mail]] On Behalf Of Erik Andersen
> Sent: Thursday, November 19, 2015 11:52 AM
> To: [e-mail]; 'PKIX' <[e-mail]>
> Subject: [x500standard] SV: [pkix] Indirect CRLs
> 
> Within X.509 there is not even a small paragraph introducing indirect CRLs
> where such information could be introduced. Besides the brief definition,
> iCRLs are mentioned the first time within the CRL scope extension (which is
> deprecated).
> 
> Erik
> -----Oprindelig meddelelse-----
> Fra: pkix [mailto:[e-mail]] På vegne af Santosh Chokhani
> Sendt: 19 November 2015 17:27
> Til: [e-mail]
> Cc: [e-mail]; 'PKIX' <[e-mail]>
> Emne: Re: [pkix] [x500standard] Indirect CRLs
> 
> Without doing the latter, the relying party will not be able to use the
> indirect CRL to verify the revocation status of the certificate in the scope
> of the indirect CRL.
> 
> -----Original Message-----
> From: Martin Rex [mailto:[e-mail]]
> Sent: Thursday, November 19, 2015 9:54 AM
> To: Santosh Chokhani <[e-mail]>
> Cc: [e-mail]; 'PKIX' <[e-mail]>
> Subject: Re: [pkix] [x500standard] Indirect CRLs
> 
> Santosh Chokhani wrote:
>> Yes.  That is an indirect CRL.
>>
>> Note that the CA needs to assert appropriate cRLIssuer in the 
>> DistributionPoint field of CRL DP extension of each certificate the CA 
>> issues.
> 
> Huh?  The latter comment has exactly nothing to do with indirect CRLs.
> 
> -Martin
> 
> _______________________________________________
> pkix mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pkix
> 
> -----
> www.x500standard.com: The central source for information on the X.500
> Directory Standard.
> 
> 
> -----
> www.x500standard.com: The central source for information on the X.500
> Directory Standard.
> 
> -----
> www.x500standard.com: The central source for information on the X.500
> Directory Standard.
> 
> 
> _______________________________________________
> pkix mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pkix
> 
> _______________________________________________
> pkix mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pkix
>