Hodie XIV Kal. Aug. MMXI, y...@inbox.lv scripsit: > If that CRL is trying to revoke that root certificate, what in that CRL > could ber forged?
If that CRL tells the private key is compromised, how could you trust this CRL (since it was signed by a compromised private key)? > CRL can only revoke a CRT, not unrevoke, right? Yes, it can. A CRL is a "present state" of revoked certificates. Remove a certificate's serial number from a CRL, it is no longer revoked. A root CA can not be revoked, that's all. Think of revocation as an automatic way to suspend trust in a certificate. PKI only transfers trust, it doesn't create it. The trust that is transferred (by signing and/or revoking certificates) is explicitely (and manually) placed into the root, by an off-band method. Revocation of the root would consist of removal of this trust, and as it was manually added, it also must be manually removed. > I know, that when revoking a certificate, CRL is signed by certificate > issuer (CA), > is there a reason, why a (small) CRL could not be signed by cartificate > itself? CRL scope. Read X.509. > (after all, anyone using leaked private key would be intereseted to delay > revocation, > but they have no means of preventing it) -- Erwann ABALEA <erwann.aba...@keynectis.com> Département R&D KEYNECTIS 11-13 rue René Jacques - 92131 Issy les Moulineaux Cedex - France Tél.: +33 1 55 64 22 07 http://www.keynectis.com ----- All wiyht. Rho sritched mg kegtops awound? ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager majord...@openssl.org
