Re: [sidr] Erratum for RFC6486? (manifests)

[Stephen Kent <[e-mail]>]

Tim,

Section 5.1 of RFC 6486 is titled "Manifest Generation Procedure." This 
it is a set of directions to the CA creating the manifest, not 
directions to an RP verifying a
manifest. Section 6 is the discussion of what a relying party is 
supposed to do with a manifest. My quick re-read of Section 6 does not 
call for an RP to check that the validity time is consistent with the 
single-use vs. sequential-use EE cert criteria in 5.1. So, the primary 
concern you cited, i.e., that an RP cannot know which test to apply, is 
not a valid
reason to change this text.

I agree that the invalid vs. stale disparity that arises because of the 
directions to
CAs on manifest EE cert generation is an awkward one. Your example of a 
manifest with
a planned daily update, but a cert that is valid for a week, is an 
reasonable operational
model. If RPs continue to fetch data based on what has changed, then a 
manifest that is
slated to change, but doesn't, doesn't impose an addition sync load. If 
an RP were to
fetch data based on when it says it will expire, then this might be less 
desirable. So
we might take that into consideration when suggesting this model.

If we had guidelines for best practices for pub point management, with 
suggested
rates of change, we might better understand the possible impact of this 
operational
model. For example, if the recommended frequency of CRL issuance is 
daily, then the
manifest ought to change daily as well, the there's a decent chance that 
the CRL and
the manifest are either both stale or current.

So, while I believe that there is no need to change the 5.1 text based 
on the
RP concern you cited, I support a change to that text to allow CAs more
flexibility in managing the EE cert validity in manifests, and to remove the
single-use vs. sequential-use EE cert distinction.

Would you like to propose and share text for the suggested change? We 
may have to
issue a new RFC, updating 6486, since this does represent a technical 
change to
how we say a CA should behave.

Steve