Geoff,
Thnaks for the speedy reply. As I noted, if the WG is still
comfortable with the name-change approach to key rollover, I am not
opposed, and I don't see it causing problems for key rollover (or alg
migration) approaches that we're developing.
I'm not sure that the issuing CDP is a bad option. Each resource cert
already contains a CRLDP extension, pointing to the CRL on which the
cert will appear if it is revoked. If one put the same URI into the
CRL, in the Issuing distribution point extension, that would seem to
allow an easy check to ensure that the CRL being checked it the right
one for the cert in question. (That's the reason the CRL IDP
extension exists.) I'll ask David Cooper, Tim, and Russ for their
perspectives on this. My view is that not having to change the CA
name each time the CA rekeys is simpler, and if we can remove the
serial number attribute feature that we added to compensate for the
name change, I think that would be preferable as well.
Upon further reflection I agree with you that the res cert profile is
probably the best place to document the decision, if we elect to keep
the name change procedure. We also would need to document the use of
the CRL IDP extension, and explain the rationale for its use here, if
we elect to go that way.
Steve
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
