Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA11669 for ; Mon, 29 Mar 2004 22:16:21 -0500 (EST) Received: from above.proper.com (localhost.vpnc.org [127.0.0.1]) by above.proper.com (8.12.11/8.12.8) with ESMTP id i2U1qZJp093091; Mon, 29 Mar 2004 17:52:35 -0800 (PST) (envelope-from owner-ietf-pkix@mail.imc.org) Received: (from majordom@localhost) by above.proper.com (8.12.11/8.12.9/Submit) id i2U1qZJw093090; Mon, 29 Mar 2004 17:52:35 -0800 (PST) X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-pkix@mail.imc.org using -f Received: from localhost.localdomain (Kix2-fe0-bb.kornet.net [168.126.16.8] (may be forged)) by above.proper.com (8.12.11/8.12.8) with ESMTP id i2U1qVET093079 for ; Mon, 29 Mar 2004 17:52:33 -0800 (PST) (envelope-from hwshim@signgate.com) Received: from COOL (cool.signgate.co.kr [168.126.16.47]) by localhost.localdomain (8.12.5/8.12.5) with ESMTP id i2U1hRE4001805; Tue, 30 Mar 2004 10:43:30 +0900 Message-Id: <200403300143.i2U1hRE4001805@localhost.localdomain> Reply-To: From: "Shim Heewon" To: "'Stefan Santesson'" Cc: Subject: RE: Freshest CRL Date: Tue, 30 Mar 2004 10:52:27 +0900 Organization: ??????(?) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_008F_01C41645.1907C2B0" X-Mailer: Microsoft Office Outlook, Build 11.0.5510 Thread-Index: AcQV2fVVTMzOtGsQQdG4B+Up+gj0ogAE12hg X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 In-Reply-To: <0C3042E92D8A714783E2C44AB9936E1DE06FF4@EUR-MSG-03.europe.corp.microsoft.com> Sender: owner-ietf-pkix@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: This is a multi-part message in MIME format. ------=_NextPart_000_008F_01C41645.1907C2B0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Of course, both of them are needed Freshest CRL. (Cert and CRL extension) 1. Using Freshest CRL extension on Certificate, you can find exact URI to get exact CRL. 2. Using Freshest CRL extension on CRL (matching on Cert), you can determine whether this CRL is the correct one among other delta CRLs or not. Because of replace attack of CRL, you should use this extension on both of them. This case is very similar to the case of CRL Distribution Point (on Cert) and Issuing Distribution Point (on CRL). _____ From: owner-ietf-pkix@mail.imc.org [mailto:owner-ietf-pkix@mail.imc.org] On Behalf Of Stefan Santesson Sent: Tuesday, March 30, 2004 7:06 AM To: ietf-pkix@imc.org Subject: Freshest CRL Is Freshest CRL supposed to be a Certificate extension or a CRL extension? I have always believed that it was a CRL extension, as defined in RFC 3280 section 5.2.6: 5.2.6 Freshest CRL (a.k.a. Delta CRL Distribution Point) The freshest CRL extension identifies how delta CRL information for this complete CRL is obtained. However, In X.509, this extension is defined a s a certificate extension only in section 8.6.2.6 8.6.2.6 Freshest CRL extension The freshest CRL extension shall be used only as a certificate extension and may be used in certificates issued to authorities as well as certificates issued to users. This field identifies the CRL to which a certificate user should refer to obtain the freshest revocation information (e.g.: latest dCRL). This field is defined as follows: Which is correct? Stefan Santesson Program Manager, Windows Security ------=_NextPart_000_008F_01C41645.1907C2B0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Of = course, both of them are needed Freshest CRL. (Cert and CRL = extension)

1.       = Using Freshest CRL extension on = Certificate, you can find exact URI to get exact CRL.

2.       = Using Freshest CRL extension on CRL = (matching on Cert), you can determine whether this CRL is the correct one among other = delta CRLs or not.

 

Because of = replace attack of CRL, you should use this extension on both of = them.

This case is very similar to the case of CRL Distribution Point (on Cert) and Issuing Distribution Point (on CRL).

 

 

From: owner-ietf-pkix@mail.imc.org [mailto:owner-ietf-pkix@mail.imc.org] = On Behalf Of Stefan Santesson
Sent: Tuesday, March 30, = 2004 7:06 AM
To: ietf-pkix@imc.org
Subject: Freshest = CRL

 

Is Freshest CRL supposed to be a Certificate extension or a CRL extension?

I have always believed that it was a CRL = extension, as defined in RFC 3280 section 5.2.6:

 

 

5.2.6  Freshest CRL (a.k.a. Delta CRL Distribution Point)

 

   The freshest CRL extension = identifies how delta CRL information for this complete CRL is = obtained.

 

 

However,

 

In X.509, this extension is defined a s a = certificate extension only in section 8.6.2.6

 

8.6.2.6     Freshest CRL extension

The freshest CRL extension shall be used only = as a certificate extension and may be used in certificates issued to = authorities as well as certificates issued to users. This field identifies the CRL to = which a certificate user should refer to obtain the freshest revocation = information (e.g.: latest dCRL). This field is defined as follows:

 

 

Which is correct?

 

 

Stefan = Santesson

Program = Manager, Windows Security

 

------=_NextPart_000_008F_01C41645.1907C2B0--