IETF Logo Mail Archive

RE: Online Certificate Revocation Protocol

"Carlin Covey" <ccovey@cylink.com> Fri, 08 June 2001 01:47 UTC

Received: from above.proper.com (above.proper.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with SMTP id VAA18276 for <pkix-archive@odin.ietf.org>; Thu, 7 Jun 2001 21:47:20 -0400 (EDT)
Received: by above.proper.com (8.9.3/8.9.3) id SAA26656 for ietf-pkix-bks; Thu, 7 Jun 2001 18:18:02 -0700 (PDT)
Received: from exchange.cylink.com (exchange.cylink.com [192.43.161.25]) by above.proper.com (8.9.3/8.9.3) with ESMTP id SAA26651 for <ietf-pkix@imc.org>; Thu, 7 Jun 2001 18:17:56 -0700 (PDT)
Received: from COVEY (cpe-24-221-22-222.az.sprintbbd.net [24.221.22.222]) by exchange.cylink.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id MNJC0YGQ; Thu, 7 Jun 2001 18:17:40 -0700
From: Carlin Covey <ccovey@cylink.com>
To: hansenw@ece.ubc.ca, madwolf@openca.org
Cc: ietf-pkix@imc.org
Subject: RE: Online Certificate Revocation Protocol
Date: Thu, 07 Jun 2001 18:18:02 -0700
Message-ID: <KHEDLMGGCCGHDAAKNAFOOEINCAAA.ccovey@cylink.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="gb2312"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
In-Reply-To: <3B201DED.6D86559E@home.com>
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
Sender: owner-ietf-pkix@mail.imc.org
Precedence: bulk
List-Archive: <http://www.imc.org/ietf-pkix/mail-archive/>
List-ID: <ietf-pkix.imc.org>
List-Unsubscribe: <mailto:ietf-pkix-request@imc.org?body=unsubscribe>
List-ID: <ietf-pkix.imc.org>
Content-Transfer-Encoding: 7bit

Massimiliano,

If you are interested in a protocol that indicates whether a
certificate has been revoked, then the OCSP document that Hansen
referred you to is appropriate.  You can get it at
http://www.ietf.org/rfc/rfc2560.txt)

Version 2 of the OCSP protocol is described in an Internet Draft
available at
http://www.ietf.org/internet-drafts/draft-ietf-pkix-ocspv2-02.txt

Simple Certificate Validation Protocol is another candidate.  You
can get the latest version of this at
http://www.ietf.org/internet-drafts/draft-ietf-pkix-scvp-05.txt

But none of these allow a certificate to be revoked. I gather that
you are interested in a protocol for requesting revocation of certificates.
Check out CMP, available at
http://www.ietf.org/internet-drafts/draft-ietf-pkix-rfc2510bis-04.txt

Regards,

Carlin

____________________________

-  Carlin Covey
   Cylink Corporation


-----Original Message-----
From: owner-ietf-pkix@mail.imc.org [mailto:owner-ietf-pkix@mail.imc.org]On
Behalf Of Hansen Wang
Sent: Thursday, June 07, 2001 5:36 PM
To: madwolf@openca.org
Cc: ietf-pkix@imc.org
Subject: Re: Online Certificate Revocation Protocol


Massimiliano Pala wrote:
>
> Hi all,
>
> I am in search of some help and suggestions about certificate revocation.
The
> problem is that, as far as I know, no rfc covers a possible online
revocation
> protocol to be used to revoke a certificate.

Isn't that what OCSP supposed to do? RFC 2560

2560 X.509 Internet Public Key Infrastructure Online Certificate
Status Protocol - OCSP. M. Myers, R. Ankney, A. Malpani, S. Galperin,
C. Adams. June 1999.

Also Certificate Revocation Status is also a per request - per response
system.


>
> The model I am thinking of is request-response oriented and, depending on
> the policy adopted by the corresponding CA, permits a user/router/etc...
to
> ask for revocation of a certificate. This can help environments where
> certificates from different vendors are used and we want to be able to ask
> for revocation without having to follow different procedures for different
> CSP -- additional steps could/shall, depending on the policy adopted,
> be taken to accomplish the revocation process.
>
> Has my problem a solution yet ??? Or can I work on a proposal to be
> submitted for comments and reviews ???

-
Hansen Wang
<http://members.home.net/hansen.wang/

v2.23.0 | Report a Bug | By Email