Problem with Indirect CRL with DPV/DPD

["Julien Stern" <[e-mail]>]

Greetings,

I keep on having a major problem with indirect CRLs, and I do not see
how they can be used with DPV/DPD (or RFC3126 actually, but this might
be out of scope).

As a matter of fact, my understanding of RFC3379 (requirements for DPV/DPD)
and the draft DPV and DPD over OCSP is that in DPD the client should
receive enough information to perform all the validity checks by
himself.

I can see that this works very well when no indirect CRL is used.
However, when an indirect CRL is used, an EXTRA certificate path
that should be used to validate the CRL issuer certificate should be
provided to the client. And if there is any other indirect CRL in
this new path, yet another extra CRL and another extra certificate path
should be sent, and so on (recursively).

I do not see how this information can be provided through DPD.

As a side note, the same problem occurs in RFC3126 where it seems the
validation information provided is not enough when indirect CRL are
used.

All these protocols seem to imply that the same path can be used to
validate a certificate and the corresponding CRL, which is not the case.
How am I supposed to verify an (indirect) CRL when the only information
provided to me is the X500Name of the CRL issuer ?

Any clarification would be appreciated.

--
Julien