Re: [lamps] draft-housley-lamps-norevavail-00

[Tim Hollebeek <[e-mail]>]

I was aware of that argument, but I was wondering if there was anything additional going on here that I had failed to think of.  With some people being very focused on certificate size, having an extension B that says “extension A intentionally left blank” perhaps needs some justification.  Or perhaps not.  On balance, I think it is best people have the option to be able to do so, for the reasons Rich mentions, but I have no strong feelings about it.

Since Mike mentioned browsers, when this last came up at CABF about seven years ago, we also answered the question about how browsers would handle this.  It’s actually trivial since they all mostly soft-fail on OCSP anyway.  In fact, in response to those discussions, Mozilla added code to ignore OCSP extensions for certificates with lifetimes less than some small number of days.  Some people even use it.

-Tim

From: Mike Ounsworth <[e-mail]>
Sent: Friday, May 19, 2023 12:48 PM
To: Salz, Rich <rsalz=[e-mail]>; Tim Hollebeek <[e-mail]>; Russ Housley <[e-mail]>; LAMPS <[e-mail]>
Cc: Joe Mandel <[e-mail]>; Tomofumi Okubo <[e-mail]>
Subject: RE: [lamps] draft-housley-lamps-norevavail-00

> In my security experience, it is always better to explicitly state something – the alarm did not sound – rather than have something implied by its absence

Fair enough.

---
Mike Ounsworth

From: Salz, Rich <rsalz=[e-mail]<mailto:rsalz=[e-mail]>>
Sent: Friday, May 19, 2023 10:44 AM
To: Mike Ounsworth <[e-mail]<mailto:[e-mail]>>; Tim Hollebeek <[e-mail]<mailto:[e-mail]>>; Russ Housley <[e-mail]<mailto:[e-mail]>>; LAMPS <[e-mail]<mailto:[e-mail]>>
Cc: Joe Mandel <[e-mail]<mailto:[e-mail]>>; Tomofumi Okubo <[e-mail]<mailto:[e-mail]>>
Subject: [EXTERNAL] Re: [lamps] draft-housley-lamps-norevavail-00

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.
________________________________
So yeah, exactly what Tim said: in what case is it helpful to explicitly state “No revocation info available” vs just leaving those extns out?

(Separate thread, separate issue)

In my security experience, it is always better to explicitly state something – the alarm did not sound – rather than have something implied by its absence – did the alarm sound? Do I know the CA is modern, did it make a mistake (been known to happen), etc.


Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.