Subject: Re: Huge CRLs

From: Ed Gerck <[email-masked]>
Date: Mon, 13 Sep 1999 12:30:35 -0700

Bob Jueneman wrote:

> Isn't this problem solved by the use of the CRLDistributionPoint
> mechanism?
>
> Is thought IE5 was already checking CRLs, if the CRLDistributionPoint
> was specified?

Bob:

It seems that Entrust.net certs + IE 5.0 affords the CRL verification process.  There
also other specialized combinations I am aware of  and it would be good to
hear about current work in this front, especially on CRLs for cross-certification.
But,  still, SSL in current browsers does  not allow a client to send a list of
trusted CAs to the server.  So, if we believe that the decision of trust should
be verifier-centric then  it does not help much to be able to verify what you are
told to trust.  And yet, providing this capability would not seem to be
rocket-science for the client side (since the server already has it)

So, what the user community might desire is a SSL protocol improvement
in order to have the necessary trust freedom to choose browser and CA
from the client side.  I for example, without any bias against Microsoft,
refuse to trust the IE browser for a variety of reasons -- even though I
would trust an Entrust.net cert for some purposes.

The first nail to bang on seems thus to be the SSL protocol, the second one
the CRL process itself for the other reasons mentioned in this thread. And,
I agree with Phil that banging on the CRL nail right now might be quite
unproductive.

Cheers,

Ed Gerck

PS: enjoyed your disclaimer ;-)

> DISCLAIMER:
>   If this message (with or without attached documents) is digitally
> signed, and/or if certificates are attached, the intended purpose is to
>
>    (1) Ensure that e-mail came from the apparent sender
>    (2) Protect e-mail from tampering
>    (3) Ensure that the content of e-mail sent to me and encrypted in
> my dual-use key cannot be viewed by others.
>   It is explicitly NOT the intent of any such signed message or
> document to represent any type or form of legally binding contract or
> other representation, and any such interpretation should not be
> considered commercially reasonable and WILL BE REPUDIATED,
> notwithstanding any wording or implications to the opposite effect in
> the text of the message itself; due in part, but not exclusively, to the
> fact that the security of my workstation and its associated cryptography
> is not judged adequately strong for such purposes at present.