Re: clarification proposal -- Re: Current status of CRL validation ?

[Stephen Kent <[e-mail]>]

At 3:31 PM -0700 4/5/04, Ed Gerck wrote:
>Stephen Kent wrote:
>>  Ed,
>>
>>  PKIX is winding down now; we are not taking on any new work items. I
>>  suspect that anything as basic as what you allude to would be a
>>  significant departure from what we have done, and thus is not
>>  appropriate for PKIX to pursue.
>
>Steve,
>
>How about a clarification to be added to the current PKIX documents
>that deal with revocation and validation of certs? This would help
>the weary reader, who must otherwise wade through this list's archives
>in order to find the limitations we have been discussing. For example
>(using some of your previous text):
>
>NOTE:
>  In X.509/PKIX only the issuer of a certificate can revoke it and there
>  is only one issuer for a given certificate. Therefore, a certificate
>  is either revoked or not. However, the ability of a RP to establish
>  the validity of a certificate is a function of the certificate path
>  that the RP uses to validate the certificate, and of the access to
>  revocation status information available to the RP. Since there may be
>  more than one path used to validate the same certificate, it is possible
>  to obtain different answers to the question whether a certificate is
>  valid, depending on which path the RP uses. Also, two RPs may have
>  access to different revocation status data for the EE certificate or for
>  a CA certificate along a path, so that each RP may arrive at a different
>  view of the validity of the EE certificate at any given time.
>
>  Moreover, in X.509/PKIX reliance terms, one may trust the confirmation
>  procedures of the issuer CA, the issuer CA Designated Responder or any
>  Trusted Responder during certificate reliance (i.e., whether the
>  certificate has been revoked or not) under CRLs or OCSPs, but one cannot
>  rely upon them for other than their value as a representation of the
>  issuer CA revocation management as expressed in the issuer CA own terms
>  and rules, usually contained in the CA CPS.
>
>Comments?
>
>Cheers,
>Ed Gerck

We have a suggestion before the WG to issue an update to 3280, so the 
WG can decide if text of the sort noted above should be part of the 
update, if we proceed on that work item.

With regard to the text above, I like the first paragraph :-), but 
the second one becomes murky very quickly. The paragraph doesn't 
convey any meaning to me.
It probably doesn't help that the paragraph is one, 6 line sentence, 
or that it introduces terms such as "CA Designated Responder," 
"Trusted Responder," ...

Steve