[lamps] AD initial comments on draft-ietf-lamps-crl-validation

[Deb Cooley <[e-mail]>]

Huzzah!  a draft I understand (I might be a touch rusty).  These are only
initial comments, I will have more once I understand the real scope of this
draft.


General:  Is this correct?  The general concern is that RFC 5280 requires
CAs to include the key usage extension when creating a certificate that is
meant to sign CRLs.  But there is no requirement for the RP to validate
that the key usage extension is on a certificate that has been used to
create a CRL.

What about a similar situation with certificate signing? I see in section
4.2.1.3 the requirement for the CA to use a key usage extension, but I see
Section 6.1.4.n. that says: 'If a key usage extension is present, verify
that the keyCertSign bit is set.' which looks similar to the CRL
situation.  What am I missing?

This leads me to one question:  Does this specification need to be
broadened to include the case of a bogus CA where a TA (or CA) has signed a
cert that has no key usage extension?

Specific comments:

Abstract:  Add a specific sentence that states that this specification
updates RFC 5280.  Normally, this is at the end of the abstract.

Abstract:  This sentence isn't really clear.  CRL validators can be RPs...
The introduction states
 this more clearly.  Maybe use that language for the Abstract (with the
sentence about updating RFC 5280).

Section 3:  Some ideas of how to simplify/clarify the CRL validation issue.
a.  Para 2&3:  How important is it to understand indirect CRLs vs direct
CRLs?
b.  Para 4&5:  Keep this.  It is clear and explains the issue.
c.  Para 6 is fine, the quote doesn't appear to support the para above.  I
would remove the quote.
d.  The example is horribly complicated.
   - It can be much simpler:  A CA issues a certificate w/out a key usage
extension, that private key is used to generate a bogus CRL, and voila we
have an issue.
   - I have not included CRL DP.

I'll have more comments once I understand more about what is necessary.  I
have not even looked at Section 4 & Section 5. But why not MUST use v3 and
KU?  why only RECOMMEND?

Deb