Re: [pkix] [x500standard] Re: Indirect CRLs

["Erik Andersen" <[e-mail]>]

Hi David,

Thanks for your input. 

You are touching on something about entities. The entity concept is somewhat
confusing. I have made a suggestion in the form of a defect report I have
not so far published. I am not sure how it will be received. I have not
included the issue on entity naming as you mentioned. The proposed defect
report may be found on http://www.x500standard.com/uploads/Ig/DR_414.pdf.  I
will be happy for any comments and/or proposed enhancement.

Kind regards,

Erik
-----Oprindelig meddelelse-----
Fra: Kemp, David P. [mailto:[e-mail]] 
Sendt: 17 November 2015 20:45
Til: [e-mail]; 'Erik Andersen' <[e-mail]>; 'PKIX'
<[e-mail]>
Emne: RE: [x500standard] Re: [pkix] Indirect CRLs

The confusion is worse than that:

    authority: An entity, responsible for the issuance of certificates. Two
types are defined
    in this Recommendation | International Standard; a certification
authority which issues public-key
    certificates and an attribute authority which issues attribute
certificates.

    indirect CRL (iCRL): A revocation list that contains at least revocation
information about
    certificates issued by authorities other than that which issued this
CRL.


According to these definitions, an iCRL is issued by an authority, which can
be only an issuer of PKCs or an issuer of ACs.  That's not just confusing,
it's wrong.

But assuming that a third type of authority is added to the definition,
there is still the question of the relationship between entities and
identifiers.  If one entity has more than one identifier (e.g., a CA cert
containing one subject name and an EE cert with a different subject name
referenced in a CRL DP), the relying party has no way of determining that
they are the same "entity".  A heuristic definition of entity would say that
two distinct identifiers refer to the same entity only if the identifiers
are bound together, e.g., by appearing in the Subject Name and Subject Alt
Name of the same certificate.

So to answer your question, if you locally generate a new PKC with another
subject name just for signing CRLs, then you have created a new authority /
entity that is distinct from the CA.



-----Original Message-----
From: [e-mail]
[mailto:[e-mail]] On Behalf Of Santosh Chokhani
Sent: Tuesday, November 17, 2015 9:39 AM
To: 'Erik Andersen'; [e-mail]; 'PKIX'
Subject: [x500standard] Re: [pkix] Indirect CRLs

Erik,

 

Yes it is.

 

There is no other mechanism defined in X.509 to delegate CRL issuance.  

 

From: Erik Andersen [mailto:[e-mail]] 
Sent: Tuesday, November 17, 2015 3:37 AM
To: 'Santosh Chokhani' <[e-mail]>;
[e-mail]; 'PKIX' <[e-mail]>
Subject: SV: [pkix] [x500standard] Indirect CRLs

 

Hi Santosh,

 

In continuation, I checked the X.509 definition for  indirect CRL :

 

3.5.36   indirect CRL (iCRL): A revocation list that contains at least
revocation information about certificates issued by authorities other than
that which issued this CRL.

 

This could be a little confusing.

 

As I understand from your answer, if I as CA delegate the CRL issuing to a
closely related function or even if I locally generate a new PKC with
another subject name  just for signing CRLs, it is still an indirect CRL.

 

Regards,

 

Erik

 

Fra: pkix [mailto:[e-mail]] På vegne af Erik Andersen
Sendt: 17 November 2015 09:14
Til: 'Santosh Chokhani' <[e-mail]>;
[e-mail]; 'PKIX' <[e-mail]>
Emne: Re: [pkix] [x500standard] Indirect CRLs

 

Hi Santosh,

 

Thanks a lot for your answer.

 

My first impression reading the text was that an indirect CRL is one that
potentially holds revocation information from multiple CAs. Others may have
the same impression. I will check X.509 to see  if it  clear enough on this
point.

 

Kind regards,

 

Erik

 

Fra: pkix [mailto:[e-mail]] På vegne af Santosh Chokhani
Sendt: 16 November 2015 17:57
Til: [e-mail]; 'PKIX' <[e-mail]>
Emne: Re: [pkix] [x500standard] Indirect CRLs

 

Yes.  That is an indirect CRL.

 

Note that the CA needs to assert appropriate cRLIssuer in the
DistributionPoint field of CRL DP extension of each certificate the CA
issues.

 

From: [e-mail]
[mailto:[e-mail]] On Behalf Of Erik Andersen
Sent: Monday, November 16, 2015 4:48 AM
To: PKIX <[e-mail]>
Cc: Directory list <[e-mail]>
Subject: [x500standard] Indirect CRLs

 

I have a question related to indirect CRLs. RFC 5280 in Section 5:

 

If the scope of the CRL includes one or more certificates issued by

an entity other than the CRL issuer, then it is an indirect CRL.

 

If a CA has delegated CRL issuing to another entity, but this entity only
issues revocation status for certificates issued by that CA, is the CRL then
an indirect CRL?

 

Erik