Re: Comments on <draft-ietf-pkix-crlaia-00.txt>

[Denis Pinkas <Denis.Pinkas@xxxxxxxx>]

Russ,

> Denis:
>
> Finally!  We now uncover the actual point of disagreement.

I would hope, but I am still unsure.

> You say:

 >> The same trust anchor is not a *sufficient* condition. The same node
 >> in the certification tree is the necessary condition. This implies, of
 >> course, the same trust anchor, but since two CRL issuers located at
 >> different nodes (i.e. certified by different CAS) might have the
 >> same CRL issuer name, this condition is insufficient to solve the
 >> issue.

> When policies, procedures, and practices are followed, I do not believe
> that two different CRL issuers that are subordinate to the same trust
> anchor can legitimately have the same name.

You have certainly heard of the name "Eurostar". That name was originally
used by a French truck company, and the French-British railways anyway
made accidentally a name collision with it.

We can hope that this does not happen again, but we cannot make sure it
already happened. We need to build a secure PKI, not a "nearly secure"
PKI and there ARE solutions to make it fully secure.

I also know there are current solutions which are NOT fully secure.
The goal of our group is to say how to make it secure.

> As I said yesterday, I am
> willing to add text to the Security Considerations section to state
> this.

As mentioned above, this is untrue in general.

> I am even willing to state that certificate users should not
> include trust anchors that do not have policies, procedures, and
> practices that would prevent such name collisions.

This is impossible to state since the certification tree may be growing
and thus you cannot make sure that you have explored all the tree.

See my detailed response to Stefan from a few minutes ago on what needs to 
be covered in the security considerations section.

Denis

> Russ