RE: Freshest CRL

["Shim Heewon" <[e-mail]>]

Of course, both of them are needed Freshest CRL. (Cert and CRL extension)

1.       Using Freshest CRL extension on Certificate, you can find exact URI
to get exact CRL.

2.       Using Freshest CRL extension on CRL (matching on Cert), you can
determine whether this CRL is the correct one among other delta CRLs or not.


 

Because of replace attack of CRL, you should use this extension on both of
them.

This case is very similar to the case of CRL Distribution Point (on Cert)
and Issuing Distribution Point (on CRL).

 

 

  _____  

From: [e-mail] [mailto:[e-mail]] On
Behalf Of Stefan Santesson
Sent: Tuesday, March 30, 2004 7:06 AM
To: [e-mail]
Subject: Freshest CRL

 

Is Freshest CRL supposed to be a Certificate extension or a CRL extension?

I have always believed that it was a CRL extension, as defined in RFC 3280
section 5.2.6:

 

 

5.2.6  Freshest CRL (a.k.a. Delta CRL Distribution Point)

 

   The freshest CRL extension identifies how delta CRL information for this
complete CRL is obtained.

 

 

However,

 

In X.509, this extension is defined a s a certificate extension only in
section 8.6.2.6

 


8.6.2.6     Freshest CRL extension


The freshest CRL extension shall be used only as a certificate extension and
may be used in certificates issued to authorities as well as certificates
issued to users. This field identifies the CRL to which a certificate user
should refer to obtain the freshest revocation information (e.g.: latest
dCRL). This field is defined as follows:

 

 

Which is correct?

 

 

Stefan Santesson

Program Manager, Windows Security