IETF Logo Mail Archive

Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15

mrex@sap.com (Martin Rex) Wed, 03 April 2013 08:11 UTC

Return-Path: <mrex@sap.com>
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B08CE21F857E for <pkix@ietfa.amsl.com>; Wed, 3 Apr 2013 01:11:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.199
X-Spam-Level:
X-Spam-Status: No, score=-10.199 tagged_above=-999 required=5 tests=[AWL=0.050, BAYES_00=-2.599, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uc8wpaVkw1Ml for <pkix@ietfa.amsl.com>; Wed, 3 Apr 2013 01:11:13 -0700 (PDT)
Received: from smtpde02.sap-ag.de (smtpde02.sap-ag.de [155.56.68.140]) by ietfa.amsl.com (Postfix) with ESMTP id 0C1F221F8573 for <pkix@ietf.org>; Wed, 3 Apr 2013 01:11:07 -0700 (PDT)
Received: from mail05.wdf.sap.corp by smtpde02.sap-ag.de (26) with ESMTP id r338B3eF011423 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 3 Apr 2013 10:11:03 +0200 (MEST)
In-Reply-To: <201304030758.r337wFTY012218@mail.nbusr.sk>
To: Peter Rybar <rybar@nbusr.sk>
Date: Wed, 03 Apr 2013 10:11:03 +0200
X-Mailer: ELM [version 2.4ME+ PL125 (25)]
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="US-ASCII"
Message-Id: <20130403081103.B40A61A68A@ld9781.wdf.sap.corp>
From: mrex@sap.com
X-SAP: out
Cc: pkix@ietf.org, sts@aaa-sec.com, 'Stefan Santesson' <stefan@aaa-sec.com>
Subject: Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: mrex@sap.com
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/pkix>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 03 Apr 2013 08:11:18 -0000

Peter Rybar wrote:
> 
> When is used the "revoked" response for certificate serial number that
> is not associated with issued certificate then the OCSP nextUpdate
> field is not used and OCSP thisUpdate field is better to be set to some
> strange value or to proposed value of issuer CA cert notBefore.

I strongly disagree and consider this a bad idea.

There is already a special value assigned to the revocationDate.
Messing around with thisUpdate/nextUpdate is not going to provide
any additonal value, but will cause confusion, be incompatible with
the rfc2560-defined semantics of thisUpdate/nextUpdate and may even
cause problems -- depending on the ordering of the checks performed
while processing an OCSP response.

-Martin

v2.23.0 | Report a Bug | By Email