IETF Logo Mail Archive

Re: Online Certificate Revocation Protocol

Massimiliano Pala <madwolf@hackmasters.net> Fri, 08 June 2001 09:39 UTC

Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with SMTP id FAA08186 for <pkix-archive@odin.ietf.org>; Fri, 8 Jun 2001 05:39:17 -0400 (EDT)
Received: (from majordomo@localhost) by above.proper.com (8.9.3/8.9.3) id BAA03329 for ietf-pkix-bks; Fri, 8 Jun 2001 01:58:13 -0700 (PDT)
Received: from mail.hackmasters.net (IDENT:postfix@[217.133.253.143]) by above.proper.com (8.9.3/8.9.3) with ESMTP id BAA03324 for <ietf-pkix@imc.org>; Fri, 8 Jun 2001 01:58:06 -0700 (PDT)
Received: from hackmasters.net (galadriel.mpcnet.org [10.5.122.180]) by mail.hackmasters.net (Postfix) with ESMTP id 1634A3CB5 for <ietf-pkix@imc.org>; Fri, 8 Jun 2001 12:03:47 +0200 (CEST)
Message-ID: <3B209485.CD2CB49A@hackmasters.net>
Date: Fri, 08 Jun 2001 11:01:57 +0200
From: Massimiliano Pala <madwolf@hackmasters.net>
Reply-To: madwolf@openca.org
Organization: OpenCA
X-Mailer: Mozilla 4.77 [en] (X11; U; Linux 2.2.18 i686)
X-Accept-Language: en
MIME-Version: 1.0
To: ietf-pkix@imc.org
Subject: Re: Online Certificate Revocation Protocol
References: <KHEDLMGGCCGHDAAKNAFOOEINCAAA.ccovey@cylink.com>
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boundary="------------msF09EF9C4BB41B75F7A7CCDBE"
Sender: owner-ietf-pkix@mail.imc.org
Precedence: bulk
List-Archive: <http://www.imc.org/ietf-pkix/mail-archive/>
List-ID: <ietf-pkix.imc.org>
List-Unsubscribe: <mailto:ietf-pkix-request@imc.org?body=unsubscribe>
List-ID: <ietf-pkix.imc.org>

Carlin Covey wrote:

> But none of these allow a certificate to be revoked. I gather that
> you are interested in a protocol for requesting revocation of certificates.
> Check out CMP, available at
> http://www.ietf.org/internet-drafts/draft-ietf-pkix-rfc2510bis-04.txt

This could be the case, anyway I was thinking of something more "robust"
and a little bit complex -- as request/response contents -- to prevent
unauthorized revoking requesting to prevent as much as possible DoS but
allowing for a simple revocation method. This could help environments where
legal issues are also covered -- govenment PKIs, Municipalities PKIs,
etc...

The model I've been thinking of is mostly based on a structure very similar
to the model proposed in OCSP. The choosen transport mechanism could be
HTTP -- this could help browsers in adding the functionality and CSP to
implement the service.

-- 

C'you,

	Massimiliano Pala

--o-------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager]                madwolf@openca.org
                                                     madwolf@hackmasters.net
http://www.openca.org                            Tel.:   +39 (0)59  270  094
http://openca.sourceforge.net                    Mobile: +39 (0)347 7222 365

v2.23.0 | Report a Bug | By Email