IETF Logo Mail Archive

Re: [pkix] Straw-poll on OCSP responses for non-revokedcertificates.

"Art Allison" <AAllison@nab.org> Wed, 31 October 2012 14:39 UTC

Return-Path: <aallison@nab.org>
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DA5E21F87CA for <pkix@ietfa.amsl.com>; Wed, 31 Oct 2012 07:39:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.9
X-Spam-Level:
X-Spam-Status: No, score=-5.9 tagged_above=-999 required=5 tests=[AWL=0.698, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KgbPRWAZPV2B for <pkix@ietfa.amsl.com>; Wed, 31 Oct 2012 07:39:46 -0700 (PDT)
Received: from p01c11o149.mxlogic.net (p01c11o149.mxlogic.net [208.65.144.72]) by ietfa.amsl.com (Postfix) with ESMTP id 80A3821F8696 for <pkix@ietf.org>; Wed, 31 Oct 2012 07:39:38 -0700 (PDT)
Received: from unknown [208.97.234.91] by p01c11o149.mxlogic.net(mxl_mta-6.15.0-1) with SMTP id 92831905.0.2667.00-115.12030.p01c11o149.mxlogic.net (envelope-from <aallison@nab.org>); Wed, 31 Oct 2012 08:39:40 -0600 (MDT)
X-MXL-Hash: 5091382c35884c7f-c93d0e1ea0bb0a7b2bd854485722b557df26b18d
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01CDB775.794CFB74"
Date: Wed, 31 Oct 2012 10:39:03 -0400
Message-ID: <71C9EC0544D1F64D8B7D91EDCC6220200CA724BB@NABSREX027324.NAB.ORG>
In-Reply-To: <50910F9E.6000703@bull.net>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [pkix] Straw-poll on OCSP responses for non-revokedcertificates.
Thread-Index: Ac23XWgPWVBIDMW0QkeKBhfQxULK5gAF7QsQ
References: <CCB55CA3.52588%stefan@aaa-sec.com> <50910F9E.6000703@bull.net>
From: Art Allison <AAllison@nab.org>
To: pkix@ietf.org
X-Spam: [F=0.2000000000; CM=0.500; S=0.200(2010122901)]
X-MAIL-FROM: <aallison@nab.org>
X-SOURCE-IP: [208.97.234.91]
X-AnalysisOut: [v=2.0 cv=N9ye4RBB c=1 sm=0 a=tFGTPFZixTZ3yCXJchW01Q==:17 a]
X-AnalysisOut: [=uM5-4mTEQPIA:10 a=BvPfnLs-15kA:10 a=BLceEmwcHowA:10 a=g0F]
X-AnalysisOut: [pLpFZAAAA:8 a=ealCiPDQX5oA:10 a=48vgC7mUAAAA:8 a=xb3ZzoUmr]
X-AnalysisOut: [ISC49vhtYEA:9 a=CjuIK1q_8ugA:10 a=8SgyfJxrfqYA:10 a=-9UqKS]
X-AnalysisOut: [le32gA:10 a=Qd0007q6B0YA:10 a=lZB815dzVvQA:10 a=WcsbDWfkIe]
X-AnalysisOut: [Ed9LKv:21 a=FU76A4KtoyhD5ZZr:21 a=yMhMjlubAAAA:8 a=SSmOFEA]
X-AnalysisOut: [CAAAA:8 a=C2K8goYC9anXxbzR9uwA:9 a=gKO2Hq4RSVkA:10 a=UiCQ7]
X-AnalysisOut: [L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=3L4fmkktL]
X-AnalysisOut: [Sgu9vw3:21 a=RQIynhwX5I0Qbv1a:21 a=cZeU5guVsksz7qoj:21]
Subject: Re: [pkix] Straw-poll on OCSP responses for non-revokedcertificates.
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/pkix>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 31 Oct 2012 14:39:48 -0000

I am ok with the choice others suggested for option 3 - add new optional
response value = Unknown.  

 

Art Allison 
Senior Director Advanced Engineering, Technology 
National Association of Broadcasters
1771 N Street NW
Washington, DC 20036
Phone  202 429 5418
Fax  202 775 4981 
www.nab.org <blocked::http://www.nab.org>  
Advocacy  Education  Innovation 

 

From: pkix-bounces@ietf.org [mailto:pkix-bounces@ietf.org] On Behalf Of
Denis Pinkas
Sent: Wednesday, October 31, 2012 7:47 AM
To: pkix@ietf.org
Subject: Re: [pkix] Straw-poll on OCSP responses for
non-revokedcertificates.

 

Response #3 : status : unknown

 

Response #1 would also be acceptable, but as a second choice.

 

Quick explanation: "unknown" is the right status. 


If the OCSP client verifies that the response is from an authorized
responder for the CA which has issued the certificate: 
unknown is a definite response and is safe (no other mechanism SHALL be
used).

 

On the contrary, if the OCSP client does not verify that the response is
from an authorized responder for the CA which has 
issued the certificate, then another mechanism will be used : either
another OCSP server or CRLs. 


If CRLs are used, "revoked" is safer, but it is semantically incorrect.
So a change in its semantics would be mandatory.

The problem is that the change should be "revoked or unknown" which may
be rather confusing.

v2.23.0 | Report a Bug | By Email