IETF Logo Mail Archive

Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15

"Piyush Jain" <piyush@ditenity.com> Tue, 02 April 2013 16:34 UTC

Return-Path: <piyush@ditenity.com>
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B620A21F86AD for <pkix@ietfa.amsl.com>; Tue, 2 Apr 2013 09:34:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level:
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fz6MLjhEFJix for <pkix@ietfa.amsl.com>; Tue, 2 Apr 2013 09:34:14 -0700 (PDT)
Received: from mail-ye0-f171.google.com (mail-ye0-f171.google.com [209.85.213.171]) by ietfa.amsl.com (Postfix) with ESMTP id 3357421F8B11 for <pkix@ietf.org>; Tue, 2 Apr 2013 09:34:14 -0700 (PDT)
Received: by mail-ye0-f171.google.com with SMTP id r10so83997yen.2 for <pkix@ietf.org>; Tue, 02 Apr 2013 09:34:13 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:from:to:cc:references:in-reply-to:subject:date :message-id:mime-version:content-type:content-transfer-encoding :x-mailer:thread-index:content-language:x-gm-message-state; bh=eiyq/ugcyGlWYv9kRj98/aWmdzoOwHAbvAeKVG98CMc=; b=P+c9uz8houuh3dTM0JKbJZ1KtQSSHJmOJk4Nn49DsVXXRWq3z2xhHpuENa2Qw0bAOr x8FVwhOQwfgA5A0LYl+kG96/Wy/MUJd7Z5mC07KGRwAudTz8dYKb6CsmjREYL1qsqpH+ vTL12kapDR4DjUFa+WYrPV+cC70N3kHF7YcJCUsYJtCwp/ATMUnW+2UGoQOMvIfcx3X2 6CYzBae34omTBShxHoLgl2k21df3eJhVDm+4segnr6wPSTd7spGLKZx+lJycN2cTKGFJ iT4MutH4FAcG3eLuJ+ATq4xxxzAIxTX4USe6d61oOG+33FiARmQSAk5opWvy2vJKQEhy IEDw==
X-Received: by 10.236.125.226 with SMTP id z62mr15462829yhh.115.1364920453754; Tue, 02 Apr 2013 09:34:13 -0700 (PDT)
Received: from hp13 (75-25-128-241.lightspeed.sjcpca.sbcglobal.net. [75.25.128.241]) by mx.google.com with ESMTPS id 30sm4091721yhb.6.2013.04.02.09.34.12 (version=TLSv1 cipher=RC4-SHA bits=128/128); Tue, 02 Apr 2013 09:34:13 -0700 (PDT)
From: Piyush Jain <piyush@ditenity.com>
To: mrex@sap.com, 'Stefan Santesson' <stefan@aaa-sec.com>
References: <CD80BD95.5F33A%stefan@aaa-sec.com> <20130402161418.BA55B1A689@ld9781.wdf.sap.corp>
In-Reply-To: <20130402161418.BA55B1A689@ld9781.wdf.sap.corp>
Date: Tue, 02 Apr 2013 09:34:03 -0700
Message-ID: <02dc01ce2fbf$e43a7b60$acaf7220$@ditenity.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQMDP5lUk3UQBdWu0ZEyPCb8b3cSopZY+6cg
Content-Language: en-us
X-Gm-Message-State: ALoCoQk/PgHrSmpvJmOIIMHqg4hyGMUAb/qvi+FSF81eqU5yvgGWX9x+tryElxvkoHk/STprnT7b
Cc: pkix@ietf.org, sts@aaa-sec.com
Subject: Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/pkix>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 02 Apr 2013 16:34:14 -0000

 
> Anyhow, I think that rfc2560bis can not (and should not) make suggestions
> for specific values.  What values would your OCSP implementation use for
> "good" or "unknown" responses for the same CA?  Those values look like
> they might be from the right ballpark.

2560-bis states that these values correspond to those in CRLs.
Implementations that I know of set these values from the CRL for good
responses and use current time for unknown responses.

This is how 2560 defines these fields
- thisUpdate: The time at which the status being indicated is known  to be
correct
 - nextUpdate: The time at or before which newer information will be
available about the status of the certificate

So for non-issued, thisUpdate should be start of CAs validity interval (all
certs are revoked until they get issued) and nextUpdate should be current
time (a certificate with that serial can be issued anytime).

v2.23.0 | Report a Bug | By Email