Re: clarification proposal -- Re: Current status of CRLvalidation?

[Ed Gerck <[e-mail]>]

Stephen Kent wrote:
> 
> Ed Gerck wrote:
> >
> >  To decide whether a certificate has been revoked or not, a RP may
> >  trust the confirmation procedures of the issuer CA, or a proxy
> >  designated by the CA, or any third party that the RP so chooses.
> >  However, the RP cannot rely upon them for other than their value
> >  as a representation of the issuer CA revocation management policy.
> 
> Getting better. But the last sentence, as best I can make out, just
> says that the CA or its designees can only tell an RP about the
> revocation status of a cert as seen by the CA. This seems almost a
> tautology, and does not shed light on whatever subtle issue is
> lurking behind the words.

Steve,

I think your reply to Santoshi exemplifies why the second paragraph
is needed in the proposed clarification. It is not about the "revocation 
status of a cert as seen by the CA". It is about who has authoritative 
management of that status in what context.

The second paragraph is needed to assert that the issuer CA is and 
remains authoritative for the policy governing revocation management of 
certs issued by that CA in *all* contexts. Even when such revocation is 
delegated by the CA, or is designated to another entity by the cert 
subscriber or by the RP. This goes beyond the crypto math assurances 
underlying and linking the issuer CA signature of the cert and its 
possible CRL.

BTW, as an alternative to that second paragraph, I suggest: 

When deciding whether a certificate has been revoked or not, a RP 
cannot rely upon the confirmation procedures of any party that the 
RP chooses (e.g., a delegated CRL issuer, or an indirect CRL issuer)
for anything other than their value as a representation of the 
issuer CA revocation management policy. The issuer CA is authoritative 
for the revocation management of certificates issued by that CA.

Cheers,
Ed Gerck