Re: [Last-Call] [lamps] Last Call: <draft-ietf-lamps-ocsp-nonce-update-04.txt> (Online Certificate Status Protocol (OCSP) Nonce Extension) to Proposed Standard
Russ Housley <housley@vigilsec.com> Thu, 21 March 2024 04:33 UTC
Return-Path: <housley@vigilsec.com>
X-Original-To: last-call@ietfa.amsl.com
Delivered-To: last-call@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75D19C1519A6; Wed, 20 Mar 2024 21:33:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.107
X-Spam-Level:
X-Spam-Status: No, score=-7.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=vigilsec.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2YIvv8Tk9e92; Wed, 20 Mar 2024 21:33:23 -0700 (PDT)
Received: from mail3.g24.pair.com (mail3.g24.pair.com [66.39.134.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7E88C1519A3; Wed, 20 Mar 2024 21:33:23 -0700 (PDT)
Received: from mail3.g24.pair.com (localhost [127.0.0.1]) by mail3.g24.pair.com (Postfix) with ESMTP id 044C01771FD; Thu, 21 Mar 2024 00:33:23 -0400 (EDT)
Received: from smtpclient.apple (pfs.iad.rg.net [198.180.150.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail3.g24.pair.com (Postfix) with ESMTPSA id C4101177831; Thu, 21 Mar 2024 00:33:21 -0400 (EDT)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6\))
From: Russ Housley <housley@vigilsec.com>
In-Reply-To: <171092978086.62468.15291194140766445897@ietfa.amsl.com>
Date: Thu, 21 Mar 2024 00:33:08 -0400
Cc: draft-ietf-lamps-ocsp-nonce-update@ietf.org, "Roman D. Danyliw" <rdd@cert.org>, LAMPS <spasm@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <D31D5C3B-AEC6-46E4-B5A9-81D3154E7638@vigilsec.com>
References: <171092978086.62468.15291194140766445897@ietfa.amsl.com>
To: Last Call <last-call@ietf.org>
X-Mailer: Apple Mail (2.3731.700.6)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vigilsec.com; h=content-type:mime-version:subject:from:in-reply-to:date:cc:content-transfer-encoding:message-id:references:to; s=pair-202402141609; bh=+CsNpxMIJAmyn/l0Xfhzw77oOAxN/GklOX32ZuOZIy0=; b=Z5dGMtEQq1y5U2XPAEE+6t2UhcWzMvX5BwxxNQsITKsNv/EVv/YAS6Yn7nluW7vYVkDErWSEBqMG2oDpfJrrsFFvYMWQ2vzmmPLtvqzuCLlM2yjPUghbjqZZTM/bdVSyB0B+vLbNsTNTGeeV1iYUrlyUcpT+ye4dIJmh/u5kb+VZley1uRINhTFz1GBPcEhI1s2PMdmg4CEwkZfmO5m4pTjioJWMZOZmAb4/pIPlnAQipmyAnkuJKAMEGQoTnatHtIeNxU0U/YiDSReQ2XEMw0wUPN7gk/z14N2yfydzSofsjJjCHGNUTOEYvyzfTrWvlZwSMJCYzB5ein1lkEJp1Q==
X-Scanned-By: mailmunge 3.11 on 66.39.134.11
Archived-At: <https://mailarchive.ietf.org/arch/msg/last-call/vrYYDb-9X_F9UkPNprL3Vv3XKq8>
Subject: Re: [Last-Call] [lamps] Last Call: <draft-ietf-lamps-ocsp-nonce-update-04.txt> (Online Certificate Status Protocol (OCSP) Nonce Extension) to Proposed Standard
X-BeenThere: last-call@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: IETF Last Calls <last-call.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/last-call>, <mailto:last-call-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/last-call/>
List-Post: <mailto:last-call@ietf.org>
List-Help: <mailto:last-call-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/last-call>, <mailto:last-call-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 21 Mar 2024 04:33:27 -0000
This is a very straightforward update to OCSP. I compiled the ASN.1 module, and it works. Russ > On Mar 20, 2024, at 6:16 AM, The IESG <iesg-secretary@ietf.org> wrote: > > The IESG has received a request from the Limited Additional Mechanisms for > PKIX and SMIME WG (lamps) to consider the following document: - 'Online > Certificate Status Protocol (OCSP) Nonce Extension' > <draft-ietf-lamps-ocsp-nonce-update-04.txt> as Proposed Standard > > The IESG plans to make a decision in the next few weeks, and solicits final > comments on this action. Please send substantive comments to the > last-call@ietf.org mailing lists by 2024-04-03. Exceptionally, comments may > be sent to iesg@ietf.org instead. In either case, please retain the beginning > of the Subject line to allow automated sorting. > > Abstract > > RFC 8954 imposed the size constraints on the optional Nonce extension > for the Online Certificate Status Protocol (OCSP). OCSP is used for > checking the status of a certificate, and the Nonce extension is used > to cryptographically bind an OCSP response message to a particular > OCSP request message. > > Some environments use cryptographic algorithms that generate a Nonce > value that is longer than 32 octets. This document updates the > maximum allowed length of Nonce to 128 octets. This document also > modifies Nonce section to clearly define the encoding format and > values distinctively for an easier implementation and understanding. > This document is a complete replacement for RFC 8954, obsoleting RFC > 8954 and provides updated ASN.1 modules for OCSP, updating RFC 6960. > > The file can be obtained via > https://datatracker.ietf.org/doc/draft-ietf-lamps-ocsp-nonce-update/ > > No IPR declarations have been submitted directly on this I-D.
- Re: [Last-Call] [lamps] Last Call: <draft-ietf-la… Russ Housley