Re: [Sidrops] what to do when the CRL is hosed?

[Robert Kisteleki <[e-mail]>]

On 2020-03-23 14:33, Stephen Kent wrote:

>> What I am suggesting is that we *could* update 6486 and make
>> validation more restrictive regarding manifests:
>> - all objects on a manifest must be present and accounted for (I agree
>> with Job regarding partial withhold attacks)
>> - all objects on a manifest need to be validated
>> - objects that are not on a manifest can be considered invalid
>>
>> This is in-line with the specifications defined in RFC 6481 (A Profile
>> for Resource Certificate Repository Structure), which essentially says
>> that all current objects must be published, and that no invalid
>> objects may be published.
> agree.

As I wrote before, I believe that a single mistake (withheld /
unpublished object or even a bit flip) invalidating a whole repository,
and as a consequence everything that could be validated under it, is a
way to high price to pay. It also makes attacks much easier: withholding
one single object from a repo and poof, a whole subtree (forest...) is gone?

I believe a more nuanced approach is needed, like if there's a problem
on a particular validation path (a cert is missing or has an error) then
invalidate that path, if a CRL is missing then warn but use a stale one,
but leave the otherwise unaffected bits validated.

Robert