RE: [saag] X.509 certificate collision, via MD5 collisions

[Stephen Kent <kent@xxxxxxx>]

At 10:46 AM -0500 3/4/05, Robert Zuccherato wrote:
> 	<SNIP>
> There are also some practical problems with overloading the serial 
> number.  CRLs will, in most circumstances, increase in size.  Also, 
> OCSP responders that pre-compute responses may have trouble 
> pre-computing "good" responses if they cannot predict which serial 
> numbers have been used.  This issue would come up with responders 
> that work from CRLs and assume that a certificate is "good" if it's 
> serial number doesn't appear on a CRL.

An OCSP responder is only supposed to indicate whether a cert is 
revoked or not.  so, if the cert is not in the CRL,  it it not known 
to be revoked, and if it is there is it revoked. absence from the CRL 
is not necessarily an indication of a "good" cert and any inference 
of that sort is an error.

Steve