Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15

In this case when response is only about, as proposed by Piyush "Section 2.2 extends the use of the "revoked" response for certificate serial numbers that are not associated with any issued certificates.", such serial number it does not represent certificate and applications MUST not use it for validations, because certificate does not exist.

When applications already have such certificate then applications MUST start appropriate actions to inform users to contact CAs where it will be resolved.

Such additional recommended steps must be included in rfc2560bis note.

When is used the "revoked" response for certificate serial number that is not associated with issued certificate then the OCSP nextUpdate field is not used and OCSP thisUpdate field is better to be set to some strange value or to proposed value of issuer CA cert notBefore.

Probably "the virtual/fake certificate" unknown to CA or OCSP server has expired nearly after or at the time from issuer CA cert notBefore field. :o)

Peter

-----Original Message-----
From: pkix-bounces@ietf.org [mailto:pkix-bounces@ietf.org] On Behalf Of Andris Berzins
Sent: Tuesday, April 02, 2013 7:51 PM
To: Piyush Jain
Cc: 'Stefan Santesson'; sts@aaa-sec.com; pkix@ietf.org
Subject: Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15

Quoting "Piyush Jain" <piyush@ditenity.com>:
>> 
>> That would signal to relying party that relying party has received old
>> information (old thisUpdate) and would query again on nextUpdate and
>> again would get old response with old thisUpdate and so on.
>> 
>> thisUpdate and nextUpdate should be current time IMHO.
> 
> [Piyush] This is the intent.
> The information is correct as of CA start validity time and can change anyti
>me.

That information is correct not only as of CA start of validity, but also on time
requested, and therefore thisUpdate should be set to the current time, i.e.,
to the time that CA knows that certificate is still not issued.

This is what thisUpdate is about. Why to fix it to some useless value?

> 
> In this case the certificate is revoked since the CA came into being.
> The only time when this information gets updates is when the certificate get
>s issued. At that time the response will contain thisUpdate and nextUpdate f
>rom the CRL.

_______________________________________________
pkix mailing list
pkix@ietf.org
https://www.ietf.org/mailman/listinfo/pkix