IETF Logo Mail Archive

Re: clarification proposal -- Re: Current status of CRLvalidation ?

Stephen Kent <kent@bbn.com> Tue, 06 April 2004 21:03 UTC

Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA27134 for <pkix-archive@lists.ietf.org>; Tue, 6 Apr 2004 17:03:35 -0400 (EDT)
Received: from above.proper.com (localhost.vpnc.org [127.0.0.1]) by above.proper.com (8.12.11/8.12.8) with ESMTP id i36JtqQD077180; Tue, 6 Apr 2004 12:55:52 -0700 (PDT) (envelope-from owner-ietf-pkix@mail.imc.org)
Received: (from majordom@localhost) by above.proper.com (8.12.11/8.12.9/Submit) id i36Jtqs2077179; Tue, 6 Apr 2004 12:55:52 -0700 (PDT)
X-Authentication-Warning: above.proper.com: majordom set sender to owner-ietf-pkix@mail.imc.org using -f
Received: from aragorn.bbn.com (aragorn.bbn.com [128.33.0.62]) by above.proper.com (8.12.11/8.12.8) with ESMTP id i36Jtpvi077164 for <ietf-pkix@imc.org>; Tue, 6 Apr 2004 12:55:52 -0700 (PDT) (envelope-from kent@bbn.com)
Received: from [128.89.89.75] (dhcp89-089-075.bbn.com [128.89.89.75]) by aragorn.bbn.com (8.12.7/8.12.7) with ESMTP id i36Jtn7b026798; Tue, 6 Apr 2004 15:55:50 -0400 (EDT)
Mime-Version: 1.0
X-Sender: kent@po2.bbn.com
Message-Id: <p06020412bc98a5af5793@[128.89.89.75]>
In-Reply-To: <4072EABB.D2A50271@nma.com>
References: <20040323103412.GA23286@cryptolog.com> <004f01c410dc$2c0681d0$df294d0c@hq.orionsec.com> <20040323142525.GA27672@cryptolog.com> <p06020406bc861b0a4627@[128.33.244.157]> <406A0839.14F7C3A1@nma.com> <p06020401bc909a0b8ec1@[128.89.89.75]> <406B0593.FD2E1F6B@nma.com> <p06020408bc90bbc275a7@[128.89.89.75]> <406DE8AD.BC0DA38@nma.com> <p06020411bc9750745da7@[128.89.89.75]> <4071AB84.14898140@nma.com> <p0602041ebc977ad14b67@[128.89.89.75]> <4071DE2E.B5BED74A@nma.com> <p06020405bc9860671a8f@[128.89.89.75]> <4072EABB.D2A50271@nma.com>
Date: Tue, 06 Apr 2004 14:24:30 -0400
To: Ed Gerck <egerck@nma.com>
From: Stephen Kent <kent@bbn.com>
Subject: Re: clarification proposal -- Re: Current status of CRLvalidation ?
Cc: ietf-pkix@imc.org
Content-Type: text/plain; charset="us-ascii"; format="flowed"
X-Scanned-By: MIMEDefang 2.28 (www . roaringpenguin . com / mimedefang)
Sender: owner-ietf-pkix@mail.imc.org
Precedence: bulk
List-Archive: <http://www.imc.org/ietf-pkix/mail-archive/>
List-ID: <ietf-pkix.imc.org>
List-Unsubscribe: <mailto:ietf-pkix-request@imc.org?body=unsubscribe>

Ed,

>
>
>Agree. I reworded it as:
>
>  To decide whether a certificate has been revoked or not, a RP may
>  trust the confirmation procedures of the issuer CA, or a proxy
>  designated by the CA, or any third party that the RP so chooses.
>  However, the RP cannot rely upon them for other than their value
>  as a representation of the issuer CA revocation management policy.

Getting better. But the last sentence, as best I can make out, just 
says that the CA or its designees can only tell an RP about the 
revocation status of a cert as seen by the CA. This seems almost a 
tautology, and does not shed light on whatever subtle issue is 
lurking behind the words.

Steve

v2.46.0 | Report a Bug | By Email | System Status