Re: [pkix] New draft-ietf-pkix-rfc2560bis-06

["Piyush Jain" <[e-mail]>]

> 
> The other thing you seem to totally discount is that not every breach of
the
> CAs security amounts to a full and thorough compromise, i.e. that the
> attacker can get hold of an carry away the CA private signature key.
> 
> 

[Piyush] Here is the bulletin published by NIST that pertains to this issue
http://csrc.nist.gov/publications/nistbul/july-2012_itl-bulletin.pdf
NIST recommends revoking the certificate in case of impersonation and RA
compromise and revoking the CA in case of CA system or CA private key
compromise.

Let us know if/why you disagree with these recommendations and the kind of
compromise in which this extension would make sense.