IETF Logo Mail Archive

Re: [pkix] Straw-poll on OCSP responses for non-revoked certificates.

Paul Hoffman <paul.hoffman@vpnc.org> Tue, 30 October 2012 15:47 UTC

Return-Path: <paul.hoffman@vpnc.org>
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC90621F847C for <pkix@ietfa.amsl.com>; Tue, 30 Oct 2012 08:47:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.599
X-Spam-Level:
X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P8L7s0hZ8PIa for <pkix@ietfa.amsl.com>; Tue, 30 Oct 2012 08:47:48 -0700 (PDT)
Received: from hoffman.proper.com (IPv6.Hoffman.Proper.COM [IPv6:2605:8e00:100:41::81]) by ietfa.amsl.com (Postfix) with ESMTP id 4A6E521F8451 for <pkix@ietf.org>; Tue, 30 Oct 2012 08:47:48 -0700 (PDT)
Received: from [10.20.30.101] (50-1-50-97.dsl.dynamic.fusionbroadband.com [50.1.50.97]) (authenticated bits=0) by hoffman.proper.com (8.14.5/8.14.5) with ESMTP id q9UFleLB094598 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Tue, 30 Oct 2012 08:47:41 -0700 (MST) (envelope-from paul.hoffman@vpnc.org)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
From: Paul Hoffman <paul.hoffman@vpnc.org>
In-Reply-To: <CCB55CA3.52588%stefan@aaa-sec.com>
Date: Tue, 30 Oct 2012 08:47:41 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <28E66A6B-7CE5-472C-81A9-A8403264C3ED@vpnc.org>
References: <CCB55CA3.52588%stefan@aaa-sec.com>
To: Stefan Santesson <stefan@aaa-sec.com>
X-Mailer: Apple Mail (2.1499)
Cc: pkix@ietf.org
Subject: Re: [pkix] Straw-poll on OCSP responses for non-revoked certificates.
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/pkix>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 30 Oct 2012 15:47:48 -0000

> 1. Allow "revoked" response for a certificate that has not been "revoked"
> but where that OCSP responder for any other reason knows the certificate
> to be "bad".

1 seems fine *as long as* the document defining this change explicitly says "the term 'revoked' now means 'revoked or never issued'". That is, "revoked" cannot just magically mean "bad" or "not good", it needs to have a specific defined meaning. I have no problem with the use of the English word "revoked" in the protocol having a real-world meaning beyond "revoked".

--Paul Hoffman

v2.23.0 | Report a Bug | By Email