Comment on PKIX-1 - cRLSign

["Simonetti David" <simonetti_david@xxxxxxx>]

Section 4.2.1.3, Key Usage, includes a paragraph on page 25 describing
the cRLSign bit, "This bit may only be asserted in CA certificates."

The draft OpenCDP includes an extension, REVOCATION ISSUER EXTENSION,
used by a CA to indicate that it has delegated authority to one or more
other entities to issue and sign CRLs or sign OCSP responses on its
behalf.  Additionally, the ill-fated issuingDistributionPoint extension
allowed a CRL issuer other than a CA.

I suggest the statement on page 25 be removed.
-- 
David Simonetti, Booz·Allen & Hamilton Inc.