RE: clarification proposal -- Re: Current status of CRL validation ?

[Stephen Kent <[e-mail]>]

At 1:56 PM -0400 4/6/04, Santosh Chokhani wrote:
>Steve:
>
>I do not have objection to parts of the first paragraph.  But, the first two
>sentences of the paragraph are not accurate by most interpretations.  I
>quote:
>
>"In X.509/PKIX only the issuer of a certificate can revoke it and there is
>only one issuer for a given certificate. Therefore, a certificate is either
>revoked or not."
>
>Through indirect CRL issuer mechanism (as defined in X.509 and in 3280), an
>indirect CRL issuer can revoke a certificate with or without the knowledge
>of the certificate issuing CA.  Since neither standard provide operations
>related guidance (lack of this guidance is appropriate in the case of both
>the standards), a subscriber can directly contact indirect CRL issuer and
>have their certificate placed on the CRL.

Good point. I overlooked that "feature" of the newer CRLs. Of course, 
I always thought it was a very questionable feature, so maybe I was 
pre-disposed to overlook it ;-)

The problem is not so much that a subscriber could ask someone other 
than the issuer of his cert to list it on an indirect CRL, but rather 
that we have no way for an RP to know whether certs listed in this 
way are appropriately revoked, in the general case. An indirect CRL 
is not authoritative for the entries that refer to certs issued by 
other CAs. In that sense I would still argue that only the issuer can 
revoke the certs that it issues. The use of indirect CRLs is much 
like using OCSP, in that an RP that is configured to accept 
revocation status data from a CA issuing an indirect CRL implicitly 
assumes that the CA is authorized to revoke whatever certs it chooses 
to list in this fashion. i don't think we would say that any OCSP 
server can revoke any cert, even though any server can issue a 
respnse that asserts that any cert is revoked. It's an issue of 
whether a RP is configured to accept status info from an OCSP server, 
or in the case of an indirect CRL, to accept indirect 
(non-authoritative) CRL entries.

Steve