At 9:09 AM +1000 6/12/10, Geoff Huston wrote:
O...
The requirement was introduced into the res-cert draft in response
to a review comment from David Cooper:
3) Section 3.9.5 states:
In this profile, the scope of the CRL is specified to be all
certificates issued by this CA issuer using a given key pair.
The scope of a CRL MUST be all certificates issued by the issuing CA
unless the CRL includes an issuingDistributionPoint extension. So, if
the scope of CRLs is to be limited to certificates signed with a given
key pair, then the profile must either require inclusion of the
issuingDistributionPoint extension in CRLs or forbid CAs from performing
key rollover. The latter option may be implemented by having issuers
change names whenever changing the key pair used to sign certificates.
http://www.ietf.org/mail-archive/web/sidr/current/msg00476.html (and
the ensuing brief thread).
Geoff
Geoff,
Thanks for the explanation. David suggested two solutions to the
problem, and you chose to mandate changing the CA name rather than
adding the IDP extension into the CRL.
The ensuring brief thread, that I just (quickly) reviewed, entailed
message exchanges between only you and David, and involved clarifying
discussion about how one could use the iDP extension to qualify the
scope of a CRL when rekeying. (It also included a confusing excursion
into revocation reason codes, and a discussion of appropriate key
lengths to match hash algs. That latter discussion may have been
unduly biased by some NIST guidance that focuses on long term sigs
vs. certs, but ...)
I'd just like to make sure that, that the WG still agrees that this
is the preferred solution. If so, we can accommodate that in the
key/alg rollover document, and note the rationale. I do think the
rationale also should appear in the repository structure document as
well, maybe the resource cert profile too. It would take only a short
paragraph to do so.
Steve
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
