IETF Logo Mail Archive

Re: [pkix] Managing Long-Lived CA certs

Carl Wallace <carl@redhoundsoftware.com> Wed, 19 July 2017 18:06 UTC

Return-Path: <carl@redhoundsoftware.com>
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E92AE131DA0 for <pkix@ietfa.amsl.com>; Wed, 19 Jul 2017 11:06:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=redhoundsoftware.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rmzx5XIeQue6 for <pkix@ietfa.amsl.com>; Wed, 19 Jul 2017 11:06:49 -0700 (PDT)
Received: from mail-qt0-x230.google.com (mail-qt0-x230.google.com [IPv6:2607:f8b0:400d:c0d::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC86E131B76 for <pkix@ietf.org>; Wed, 19 Jul 2017 11:06:48 -0700 (PDT)
Received: by mail-qt0-x230.google.com with SMTP id b40so7956396qtb.2 for <pkix@ietf.org>; Wed, 19 Jul 2017 11:06:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhoundsoftware.com; s=google; h=user-agent:date:subject:from:to:message-id:thread-topic:references :in-reply-to:mime-version; bh=gvQJRPnkLrg57A3aAUultiUdeTiZJqA2xQgc96HiWc0=; b=1P8B9anASoM2NckocRbSS0Jstr+qNk4TfIkPG224OWWGg5uvwiI97ETJex+aJgkPtF ZUZ29SqJCfnig4N90KCZJdK3FZ3SefpdjaNuYD+Ps42Gnv/q17/n1Bo7a6Pv2RpN1UIm HKZRQpCTeCCqScQ0rhCAwHv3v9yaFwFzDebgM=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:user-agent:date:subject:from:to:message-id :thread-topic:references:in-reply-to:mime-version; bh=gvQJRPnkLrg57A3aAUultiUdeTiZJqA2xQgc96HiWc0=; b=QGQc4QOwrojuom/S55d2xamDlbMpVPZuDHabU/wZR/bwVJD16Y0dhWvqrZCyADAhvF 7FT5hdjSco1B5yWVLafmOe4jbDHyiJk6Af/hpeteHxIMfyS7vQMyR6QDPRUPyP/EEndC p9UsSOrxRd4u/MdTedMkLgtxIUlg0/C51sYQUyvRfUy0NxrPpp1nlBj20FT6FRt12Cc4 W9pyXtYAdg7swCGFbGRB4rC1UNR9ORz1+n922OzNDJTP6gkXN1VZavVLTvlNY6N/k7S0 h1WshpQCZXBODwv/UEr5kZfIrsrbQD2ckg1cDcKCrVNGOfmFobqwR1SubcGlpCaXV0IH ZMeg==
X-Gm-Message-State: AIVw1116sOHFJKILwU18C+7CkIHLngnpgaJwCv2WRZuwFBO45IX0yfdz qZ7Iz+UTsvycSz2Wa1s=
X-Received: by 10.237.34.227 with SMTP id q32mr1411923qtc.39.1500487607813; Wed, 19 Jul 2017 11:06:47 -0700 (PDT)
Received: from [192.168.2.27] (pool-173-66-76-215.washdc.fios.verizon.net. [173.66.76.215]) by smtp.googlemail.com with ESMTPSA id i8sm414638qtb.40.2017.07.19.11.06.46 (version=TLS1 cipher=AES128-SHA bits=128/128); Wed, 19 Jul 2017 11:06:47 -0700 (PDT)
User-Agent: Microsoft-MacOutlook/14.7.4.170508
Date: Wed, 19 Jul 2017 14:06:44 -0400
From: Carl Wallace <carl@redhoundsoftware.com>
To: "Dr. Pala" <director@openca.org>, <pkix@ietf.org>
Message-ID: <D59515D0.987BF%carl@redhoundsoftware.com>
Thread-Topic: [pkix] Managing Long-Lived CA certs
References: <467c8936-f6aa-0853-878c-24fc8803c599@openca.org> <001501d2ff0e$00eddfa0$02c99ee0$@x500.eu> <1500348690922.69356@cs.auckland.ac.nz> <27d212b4-c5a6-19d1-2afd-f18adaf21031@nist.gov> <003d01d2ffdd$35d67c70$a1837550$@x500.eu> <d032d03f-6ece-44e1-58b7-e3141f3b8e3d@openca.org>
In-Reply-To: <d032d03f-6ece-44e1-58b7-e3141f3b8e3d@openca.org>
Mime-version: 1.0
Content-type: multipart/alternative; boundary="B_3583318007_21969861"
Archived-At: <https://mailarchive.ietf.org/arch/msg/pkix/2zOE-wbXDSwQS4LALg8VNe6gNQM>
Subject: Re: [pkix] Managing Long-Lived CA certs
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/pkix/>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 19 Jul 2017 18:06:51 -0000

From:  pkix <pkix-bounces@ietf.org> on behalf of "Dr. Pala"
<director@openca.org>
Organization:  OpenCA Labs
Date:  Wednesday, July 19, 2017 at 1:33 PM
To:  <pkix@ietf.org>
Subject:  Re: [pkix] Managing Long-Lived CA certs

>     
>  
> 
> Hi all,
>  
> 
> I just want to point out that the extension that is mentioned is NOT the same
> as I wanted try to propose (if this is highly controversial, it can just be an
> informational RFC). The only correct answer to my question actually is:
> nothing like that exists, something similar was deprecated in RFC5280 but it
> is still used in other environments.

[CW] Re: your proposal (politics aside), it's not clear that a mechanism to
allow a CA key to live for CRL generation but not certificate signing is
necessary to serve a community that doesn't check revocation status (i.e.,
lightbulbs, in your example). An alternative that does not require new ASN.1
would be to reuse the PrivateKeyUsagePeriod syntax, define a new OID, and
declare the semantics for extensions with the OID and structure to be for CA
keys only with the caveat that CRLs and OCSP responder certificates can be
signed after the date in the extension.
>  
> 
> <very large snip>

v2.2.0 | Report a Bug | By Email