Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15

["Peter Rybar" <[e-mail]>]

Yes, "revoked" response for certificate serial number that is not associated with issued certificate can confuse validations systems.

When is used the "revoked" response for certificate serial number that is not associated with issued certificate and the OCSP thisUpdate value is actual time X and real certificate was issued in some short time before X then it will be a real confusion for clients ordering responses according to OCSP thisUpdate value when OCSP database will be later updated with a real issued certificate with the same serial number.  

To avoid it the value of thisUpdate of not issued cert must be older then thisUpdate of real certificate with the same serial number.

Peter

-----Original Message-----
From: Martin Rex [mailto:[e-mail]] 
Sent: Wednesday, April 03, 2013 10:11 AM
To: Peter Rybar
Cc: 'Andris Berzins'; 'Piyush Jain'; 'Stefan Santesson'; [e-mail]; [e-mail]
Subject: Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15

Peter Rybar wrote:
> 
> When is used the "revoked" response for certificate serial number that
> is not associated with issued certificate then the OCSP nextUpdate
> field is not used and OCSP thisUpdate field is better to be set to some
> strange value or to proposed value of issuer CA cert notBefore.

I strongly disagree and consider this a bad idea.

There is already a special value assigned to the revocationDate.
Messing around with thisUpdate/nextUpdate is not going to provide
any additonal value, but will cause confusion, be incompatible with
the rfc2560-defined semantics of thisUpdate/nextUpdate and may even
cause problems -- depending on the ordering of the checks performed
while processing an OCSP response.

-Martin