Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15

["Piyush Jain" <[e-mail]>]

http://dictionary.reference.com/browse/correspond also lists the meaning as
"to be in agreement or conformity" and this is how responder implementations
interpret it today (at least for good and revoked certificates).
The reason these specs are created is to avoid ambiguity and have
implementers interpret it in a consistent way.

> It is obviously the most recent time when this information was known to be
> correct, as per definition.
Is this based on your understanding of how existing responders set
thisUpdate in OCSP response or is it based on the dictionary meaning of
"correspond"?

For this boundary case where revoked cannot be tied to the CRL, implementers
have to think about what value to put in this field.
You seem to be saying that the right value for this field is current time. 




> -----Original Message-----
> From: Stefan Santesson [mailto:[e-mail]]
> Sent: Tuesday, April 02, 2013 1:14 PM
> To: Piyush Jain; [e-mail]
> Cc: [e-mail]; [e-mail]
> Subject: Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15
> 
> On 4/2/13 7:27 PM, "Piyush Jain" <[e-mail]> wrote:
> 
> >[Piyush] Which original guidance? There is a note that says that these
> >values correspond to the values in the CRL.
> 
> They do.
> 
> Correspond = to be similar or analogous; be equivalent in function,
position,
> amount, etc.
> (http://dictionary.reference.com/browse/correspond)
> 
> ThisUpdate in CRL (http://tools.ietf.org/html/rfc5280#section-5.1.2.4)
> 
> So it is analogous to the issuance date of a CRL, not necessarily THE
issuance
> date of a CRL.
> 
> 
> This is all inherited from RFC 2560 and has not caused confusion to my
> knowledge.
> 
> /Stefan
>