Re: Online Certificate Revocation Protocol

[Marc Branchaud <[e-mail]>]

Marc Branchaud wrote:
> 
> So here's a proposal:
> 
> If a key (CA's or otherwise) is destroyed, place the certificate on a CRL
> with a "key destroyed" reason.  This indicates that any certificates issued
> by that key on or after the time of destruction should be considered invalid.
> 
> If, before the key's certificate expires, the key is actually compromised,
> issue a new CRL with a "key compromised" revocation reason.  This fully
> revokes the certificate, with all that implies.

Perhaps the existing cessationOfOperation code could be used as a "key
destroyed" reason.  X.509 states: "cessationOfOperation indicates that the
certificate is no longer needed for the purpose for which it was issued but
there is no cause to suspect that the private key has been compromised." 
That doesn't quite fit, but it might work.

		Marc