RE: not required to support IDP?

[Peter Williams <[e-mail]>]

Summary

Side issue for the unwary, for IDPs or CRLs or OCSP
or ORACLE responses, and the distinction between revocation 
information and revocation notice

-------

For those embroiled in IP and legal matters concerning validity, 
one can note that a CA that DOES NOT issue a CRL/DP DOES NOT
issue/perform X.509 "revocation *notice*", by definition.

Similarly, only when an OCSP responder provides a 
reading-service for a CRL on which a particular revocation 
notice is first posted can an OCSP responder (under policy) be 
said to be *publishing* that revocation notice. In no
sense does the mere act by a CA of delegating authority to
an OCSP responder mean that an OCSP responder 
response performs the act of publishing an 
X.509 revocation notice. The same limitation
is true for an ORACLE database Repository 
controlled by a CA.

Relying on an OCSP or ORACLE responder to help verify a 
claimed-legal signature without very carefully reading and vetting
the validation policy of the Repository is not a 
reasonable thing to do. Sadly, the Internet's
PKI repositories mostly all make false claims about
their status as an "X.509 compliant" means for 
publishing revocation notice.


-----Original Message-----
From: David A. Cooper [mailto:[e-mail]]
Sent: Wednesday, February 20, 2002 2:12 PM
To: [e-mail]
Subject: RE: not required to support IDP?



Simon,

I agree that PKIX did not mean to suggest that one could CRL containing a
critical IDP extension even if you can not process the extension. PKIX is
simply saying that you are not required to have the ability to process the
extension, even though this will mean that you may have to reject some CRLs.

However, X.509 does not require that a CA issue full CRLs. If this
requirement did appear in X.509 (1997), it has been removed in X.509 (2000).
In fact, X.509 makes clear that CAs may choose not to issue CRLs at all.
Either because they to not revoke certificates or because they only publish
revocation information using some other mechanism (e.g., OCSP).

So, an X.509 compliant CA could issue only partitioned CRLs, in which case a
relying party that could not process the IDP extension would be unable to
obtain revocation information.

Dave

At 04:53 PM 2/20/02 +0100, Simon Tardell wrote:

>Hi Hiro,
>
>Of course, whatever extension is critical that you don't understand,
>must cause you to reject the CRL. However, according to X.509(97) 12.6.1
>f) a complete CRL shall always be issued, even if partitioned CRLs are
>also issued. That means that you don't have to support partitioned CRLs,
>since there is always (if the CA is X.509 compliant) a complete CRL to
>get. For many applications, partitioning CRLs may not even be the best
>answer to the problem you try to solve (depending on the problem of
>course).
>
>Simon
>
>Simon Tardell, Software Architect, SmartTrust
>voice [phone], fax [phone]
>cell [phone], [e-mail]
>
>
> > -----Original Message-----
> > From: Hiro [mailto:[e-mail]] 
> > Sent: den 20 februari 2002 14:57
> > To: [e-mail]
> > Subject: not required to support IDP?
> > 
> > 
> > 
> > 
> > Hi,
> > I have one question about Issuing Distribution Point 
> > Extension. In RFC2459 and draft-ietf-pkix-new-part1-12.txt, 
> > about this extension
> > 
> >     "Although the extension is critical, conforming implementations
> >      are not required to support this extension."
> > 
> > I cannot understand.
> > I think it is not only conflicting with critical flag 
> > concept, but also, if a CA is issuing CRL/ARL(not complete 
> > CRL) and it happen the CRL 
> > substitution attack
> > on the directory, EE should be find this attack.
> > So I think this extension must be supported.
> > 
> > Does anyone answer for this question?
> > 
> > Regard,
> > 
> > 
> > 
> > --
> > Hiro
> > [e-mail]