Re: [pkix] Proposed resolution to non-issued certificates - 2560bis

[Peter Rybar <[e-mail]>]

It means the time value in thisUpdate field is a time when CA database
was locked in the process of creating CRL/OCSP response. CRL contains
only revocations with time which were before time value of thisUpdate
field. Any revocatins registered while database was locked must not be
included and are included after next lock of CA database when a new
CRL will be generated.
Peter Rybar

2012/11/2, Simon Tardell <[e-mail]>:
> On Fri, Nov 2, 2012 at 11:16 AM, Peter Rybar <[e-mail]> wrote:
>
>> ** **
>>
>> Stefan,****
>>
>> ** **
>>
>> I agree with David A. Cooper and Piyush.****
>>
>> ** **
>>
>> And also retroactive revocation is not allowed in X.509.****
>>
>> The certificate status "revoked" in OCSP must be consistent with the
>> status in CRL.****
>>
>> In this case it is not consistent because status "revoked" is proposed to
>> be in OCSP but in the same time it is not included in CRL.****
>>
>> Validation will be different by CRL/OCSP!
>>
> So a CA that does answer revoked for never issued MUST NOT use CRLs.
>
>> **
>>
>> Don't forget that also thisUpdate MUST be correctly used and included in
>> OCSP response.****
>>
>> ** **
>>
>>    - thisUpdate: The time at which the status being indicated is known to
>> be correct.****
>>
>> ** **
>>
>> It mans any new "correct" revocation MUST be with revocation value which
>> is greater than value thisUpdate of any issued CRL/OCSP.
>>
> Including revocation date/time before value thisUpdate (of any already
>> issued CRL/OCSP) is destruction of X.509 fundamental rules for
>> validations.
>> ****
>>
>> Date and time of revocation MUST be only after value thisUpdate which is
>> included in last issued CRL or OCSP.****
>>
>> **
>>
>
> I don't quite understand. The revocationTime of a RevokedInfo must
> logically be earlier than the thisUpdate of the response, unless we assume
> that we are dealing with a precog OCSP responder. The OCSP responder should
> try to keep the thisUpdate as close to "now" as it can, to limit the window
> where compromised keys can be used.
>
> /Simon
>