Re: not required to support IDP?

"Housley, Russ" <rhousley@rsasecurity.com> Mon, 25 February 2002 21:04 UTC

From: "Housley, Russ" <rhousley@rsasecurity.com>
To: Hiro <yoshida@secomtrust.net>
Cc: ietf-pkix@imc.org
Message-Id: <5.1.0.14.2.20020225135649.030f2c60@exna07.securitydynamics.com>
Date: Mon, 25 Feb 2002 13:58:10 -0500
Subject: Re: not required to support IDP?
In-Reply-To: <5.0.2.7.2.20020220223318.02585c48@pop.secomtrust.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format="flowed"
Sender: owner-ietf-pkix@mail.imc.org
Precedence: bulk

Hiro:

Implementations are not required to support the extension.  However, if a 
CRL issuer chooses to support it, then it must mare it critical.  Thus, any 
client that does not support it will reject the CRL.

Russ


At 10:57 PM 2/20/2002 +0900, Hiro wrote:


>Hi,
>I have one question about Issuing Distribution Point Extension.
>In RFC2459 and draft-ietf-pkix-new-part1-12.txt, about this extension
>
>    "Although the extension is critical, conforming implementations
>     are not required to support this extension."
>
>I cannot understand.
>I think it is not only conflicting with critical flag concept, but also,
>if a CA is issuing CRL/ARL(not complete CRL) and it happen the CRL 
>substitution attack
>on the directory, EE should be find this attack.
>So I think this extension must be supported.
>
>Does anyone answer for this question?
>
>Regard,
>
>
>
>--
>Hiro
>yoshida@secomtrust.net

not required to support IDP? Hiro
RE: not required to support IDP? Simon Tardell
RE: not required to support IDP? David A. Cooper
RE: not required to support IDP? Peter Williams
Re: not required to support IDP? Housley, Russ