search

commoncriteria / X509

The Unlicense
0 stars 0 forks source link

FDP_CRL_EXT.1.1 bullet list is a mix of mandatory/selection/optional rules #1

Open woodbe opened 4 months ago

woodbe commented 4 months ago

The rules for CRLs are complex, but this is written with a number of somewhat inconsistent "ifs" and then some things that seem mandatory.

The things that are mandatory should be listed first, then things that are conditional should be listed second.

The 4th bullet seems to be a consequence of the 3rd bullet (the one with the selection). It isn't clear why this bullet needs to be specified based on the 3rd one. Maybe the third one should say "[selection: issuer, issuerAltName extension] instead. I'm not sure that saying "if you put in a null for issuer you need to use issuerAltName" is necessary, since by definition having a blank issuer field would point to needing the alternative. If this is felt to be necessary, then it should be in the EA since it is more about how to evaluate than specifying the requirement.

The last bullet states "if populated" which would seem to make this conditional, and to be consistent the "If" should be at the beginning, not buried in the middle of the sentence.

jfisherbah commented 4 weeks ago

Rules for CRL contents reorganized, with the app note clearly indicating which selections are contingent on issuerAltName being present. Believe this is now resolved, unless a "none of these" item is needed for the selection.